Don’t use the router from your ISP, nor their DNS servers, and use a VPN (I prefer commercial offerings with a WiFi access point separate to the router). I also recommend Pi-Hole DNS/Unbound servers where you can add a lot of blocklists for malware, telemetry, ads… so some connected devices on your network you aren’t running through a VPN are protected. You could run your entire network through a VPN, but that can cause problems with some services that block known VPN IPs…