Maybe running a firewall on dedicated hardware so the internet doesn't drop if you reboot the hypervisor.. but even then I just live with that and run pfSense in proxmox.
Firewall is a great example of what not to run on a vm, at least for me! I consider gateways as appliances though, and I haven't run my own router on Linux since I first got Cable internet in 2002. I remember how awesome it was compared to the weak routers available at the time!
Now I just buy a UDM Pro and forget about it!