There is more than 1 way to get that level on config without having a loud energy hungry rack mounted hw… Pfsense or openwrt are just 2 of them. Drop them on a good arm device or power efficient x86 minipc and u get the best of both worlds. You lose on the seamless updates, but unless you are some high profile or paranoic person, no APT will target that 0 day in your network…