To make sure you have at least one exploitable device with a buffer overflow triggered by a malformed TCP-packge? :D

I've been doing something vaguely similar, largely out of laziness, for the past few years. My ISP's router (largely) retains its default settings, then my main router/firewall[1] sits behind that in a double-NAT configuration (treating the ISP router as being on the WAN side). Works well enough in practice - it's never caused me any issues in the ten or so years I've been doing it (port forwarding becomes a two-step process, but I _very_ rarely need to do that, so it's a non-issue for me).

[1] Typically pfSense, though it's just a generic Eero setup for now while I reconfigure some stuff33333333