If it had Ethernet ports I'd be tempted to just use my own wifi router and put the ISP's Trojan horse in a Faraday cage. All ISP-controlled hardware should be treated as just another untrusted WAN hop.
(That was years before the other incident - since then they had dropped that idea and "generously" given customers access to the config UI)
...is sometimes a boltcutter.