Don't rely on vendors to ship you secure fimware. Use something open source such as OpenWRT. It will make implementing the protections this blog mentions much easier.
My choices are the RT-AC86U, and the RT-AX68U if you need Wifi 6 support.
Don’t get the RT-AC88U though, it has no CAKE.
(If you’re lucky enough to have a gigabit connection, you’ll need more expensive stuff.)
They do provide access to the sources, but isn't this still a violation of GPL?