Physical media is still the best quality for those of us that care. I rip it to watch digitally, but I like having the physical backup and option to watch with minimal compression.

Doesn’t need to be the case if you segment your network to protect against ARP.

Don’t have the Wi-Fi network “upstream” of the LAN. You want the connection between the LAN and Wi-Fi to be through the WAN so you get NAT protection.

The risk is the ISP Wi-Fi. As long as you’re using WPA with a good long random passkey, the risk is minimal. However, anyone who had access to your Wi-Fi could initiate an ARP spoof (essentially be a man-in-the-middle)

As an FYI: this set up is vulnerable to ARP spoofing. I personally wouldn’t use any ISP-owned routers other than for NAT.

They’ve been an extremely reputable “record-less” VPN for multiple years now.