https://www.ui.com/unifi/unifi-ap-ac-pro/ for the wired AP, https://store.ui.com/products/uap-beaconhd for the extension into the back of the house. Pricy, but not completely outrageous IMO.
For an actual router, I run OPNsense in a VM (on the same box as HA, funnily enough). My server has dual 10 gig ports, so I pass through one of them to OPNsense and run it as a "router on a stick", where the basic internal network is the untagged VLAN, and the public side is VLAN 99. My switch then strips the VLAN 99 tag from the packet before sending it to the cable modem, and vice-versa. My switch is https://mikrotik.com/product/crs328_24p_4s_rm, which was $379 in 2018. However, you can get similar functionality from MUCH cheaper microtik or unifi/ubiquity switches if you don't need 10 gig support.
If you're starting from scratch I might get something like https://store.ui.com/collections/unifi-network-unifi-os-cons..., and an el cheapo dumb switch, as long as it'd pass through vlan tagged traffic. You want anything that's crossing a vlan boundary to end up on the router anyway, so you can apply firewall rules to it.
Security risk? Not in the slightest. I'm running an up to date proxmox which is just KVM+QEMU with some scripting and a website on top, basically. I know how to setup IOMMU groups and such. If it's good enough for the big cloud providers, it's good enough for me.
> Wireless Uplink functionality enables wireless connectivity between APs for extended range. One wired UniFi AP uplink supports up to four wireless downlinks on a single operating band, allowing wireless adoption of devices in their default state and real-time changes to network topology. For devices that support Plug & Play Mesh, this functionality is extended to allow multi-hop wireless uplink – so wirelessly uplinked APs can support uplink to other wirelessly uplinked APs.
(quote is from the datasheet PDF)
I've really been trying to move away from cloud based stuff not only because of data privacy, but concerns about services going away and (most importantly) latency.
My old wifi smart plugs had 2+ seconds of latency from when I'd hit the button in HA to actually turning on. Zigbee/Z-wave stuff is (from my meatsack perspective) instant. I have a zigbee door sensor on the door to get into my garage, and a zigbee smart plug connected to the overhead florescent lights. By the time the door opens enough for me to actually see inside the garage, the lights are on. Sometimes I think they never turned off. It's fantastic.