There's nothing conceptually wrong with a modem that also contains a NAT firewall/router/switch/(WAP). But in practice, even examining the hardware architecture of a consumer-grade router reveals fundamental design flaws in terms of the monolithic nature of the hardware architecture. Thus, using separate appliances for modem, router, switch, etc., that are physically separated, is still a good idea.
Of course, once you pick apart the shortcomings of a global TCP/IP network itself, it's clear that a single pipe connected directly to the internet is also a horrible idea, security-wise. I have been asking myself of late: "Self, if we were to design the internet from scratch and from security-first principles, how would it look?" Doing so requires detaching entirely from the existing mess we've created. Actually building a new security-first internet with backwards-compatibility would be an enormous increase in complexity, and would put into question the viability of the security of trillions in investment into entrenched global-scale infrastructure. Thus, any attmepts to solve this problen -- essentially boiling the ocean(s) -- is likely to remain (literally) a (multi-)pipe dream.
However, I am hopeful that new initiatives to build out 'hyperscale' and 'edge' clouds will present a genuine opportunity to realize the dream of a secure internet, secure networking, secure devices.