and your closed source ISP mode+router combo probably routes traffic in both directions. An attacker just have to put your public IP as the gateway for 192.168/24 and he probably can access all those devices.