Then again I'm not hiding anything dubious - if I was I'd install a firewall box asap. (And yes I know the "nothing to hide" slippery slope etc argument)
This person does not do online banking, does not have a webcam or mic installed device such as a laptop, and does not have an email account.
The only reason I don't have a firewall box behind my residential router is because I don't have money to buy extra hardware.
Now, in many settings one do need a "LAN" in the sense of a firewalled playground for hopeless consumer devices, such as printers, ip web cameras etc.
Perhaps the biggest reason to have a firewall, is if you're running windows -- as unpatched windows machines live dangerously on the open Internet. And you'll be unpatched from initial install until you've patched up...
AFAIK there's been a while since any major Linux distro shipped with remote (no-action needed, like browsing) vulnerability out of the box.
As for "does not have an email account" -- I generally assume that anyone with half a brain can patch into the upstream DSLAM of my DSL line, so anything between me, and everywhere else is suspect. Which is of course why I protect my IMAP/SMTP with TLS.
[edit: consider people that use a laptop outside of the home -- they'll probably have to use dubious wireless links. It's more convenient to assume that the trust-boundary between you and the internet is at the local ethernet port/wireless card -- than anywhere else. That way you can have one set of "OpSec" that works (or not) wherever you are -- rather than fighting an uphill battle of situation awareness...]
I don't know a ton about networking (probably not too much in fact) but doesn't HTTPS fix most of this? And if your laptop grants access to its mic/webcam to any packet that manages to make it past your router, I think you have a bigger problem.
:(. that's really frustrating. So you really need to vpn to a secure network anytime you use free Wi-Fi?
Its not perfect, but as I'm pretty comfortable with the risk balance. Things like all these android apps containing god knows what make me way more jittery (See google's recent cleanup).
Asus/Netgear/D-Link/etc follow the "If we don't release an 802.11ac router every week, we won't get enough press releases out!" model, and their firmware suffers as a result.
I'm not touching those unless I can wipe the stock firmware and replace it with Tomato or DD-WRT.
Personally I trust VxWorks over some patchwork router of the week by the usual vendors. It's used in many safety critical/medical applications, including the mars rovers.
The downside being that VxWorks has very low resource requirements, so some vendors use them to cut resources. Hence, You'd better be happy with the factory provided configuration because you can't flash them.