Make sure to own your router, I’d say. Set you ISP router to modem mode and use OpnSense on a APU as router where you have full control. You can filter ads with adGuard and you can use wireGuard and openVPN to connect to a VPN provider as well as setting up an endpoint so you can protect yourself even on the go and even on locked up systems like iOS.

Except, Apple does let some of their own packages not go through VPN, which is very shady, tho.