I know it’s overkill, I got old system w/ OPNSENSE to managed switch and Ubiquity Access Points for WiFi.

Whatever you decide on be a good neighbor and go with 5GHz only if at all possible.

Love my mikrotik hex they have more advanced hardware and I just use a tp link as an access point. I migrated from a ddwrt and it's got all the features you could ask for

I run a Linksys E8450 Wifi6 router on openWRT and have had great results so far. Out of the box the antennas are internal but people have done modifications to add external antenna ports

I've been using OPNsense for a year now and I'm very happy with it. Fully open source, very stable and it offers all features you'll probably need. Runs on pretty much every hardware and is based on FreeBSD.

I'm so using an older Asus AC86U. It's receiving updates still and works just fine.

I used OpenWRT for ages on all kinds of different hardware. The next logical step up for me was into the Ubiquiti product line. That gave me a lot of the power and configurability of the OpenWRT world in something that was a lot easier to use. (Plus, their access points are quite nice.) I chose the Dream Machine Pro. It was rack-mountable, so I bought a cheap rack and put it on a shelf. I also decided to buy Ubiquiti access points and switches to take advantage of all the network management features of their OS. I have one place where I monitor, update, and configure everything, and it's about twenty times easier than keeping things updated in OpenWRT.

I just a bunch of GL.iNet routers. I know China. I know.

I never plan to go to China and my threat is western companies and governments, so china seems fine.

Honestly, It depends on your threat model. Some basic steps of security your network are more than enough for most people.

Assuring your endpoints are always up to date
Assuring you change the default SSID name and Password
Assuring you disable all features you dont utilize

If you're worried about the company viewing your data on the router, utilize a device level VPN or set up a router/Box that all traffic goes through before you hit the router (As others have mentioned) with a standalone AP and router/model so you can VPN before any traffic hits the router.