I'm curious what attack surface typical "wifi-router" has? From the internet, nothing should be exposed - or maybe OpenVPN port or ssh? From outside, usually

I'm curious what attack surface typical "wifi-router" has? From the internet, nothing should be exposed - or maybe OpenVPN port or ssh? From outside, usually you would see WPA2-PSK network. I know there are some attacks on WPA2, but I don't know if they're practical. I also know that WPS (that PIN thing) is very insecure, but that is hopefully disabled on most networks. From inside the network, things get more difficult, because the router has to have a lot of services exposed - DNS, DHCP, whatever the thing that supports UPnP is, the admin web interface, ssh, etc. This makes me think, that unless the manufacturer sneaks in a backdoor, things should be relatively secure from outside (both internet and physically). Am I missing something?