Probably safest to take a layered approach. Something with long update timeline and verifiable source. And then additionally use encrypted communication on your

Probably safest to take a layered approach. Something with long update timeline and verifiable source. And then additionally use encrypted communication on your devices behind that router (DNS as well)