RK3588 can handle 2 2.5G ports. Would bump the price a bit, but also is a significant CPU upgrade so you are likely to get much better usable bandwidth with packet inspection and/or QoS.
2. Mediatek might not be willing to provide their WiFi SoC if you are not using their compute SoC, and Rockchip doesn't have any WiFi chips.
The rk3588 is frankly a non-starter.
There are some China-only ZTE devices that do this, but they obviously have a different order volume and scale that makes it possible. (The main SoC is replaced with a ZXIC one, a ZTE subsidiary)