Help me decide what to replace my RT-AC88 (and more?) with...

[jtara]

I have an ASUS RT-AC88U (with Asuswrt-merlin installed) that I have been generally happy with. However, I've come to terms with the fact that the hardware seems to be dying. I thought it might be a heat-related issue, replaced the cooling pads with good heatsink compound, and it was "better" for a while. You can read the latesting installment of my tale of woe here:

https://www.snbforums.com/threads/rt-ac88u-wifi-traffic-throttle-problem.59232/#post-530797

The easy path is to order an RT-AX88, about $300. It will be familiar, faster (I do sometimes open an IPSEC VPN when away from home, and the RT-AC88 is somewhat CPU-constrained for this), and WiFi6. (Which I don't particularly care about for speed, but if it might improve reliability I am all ears...)

My particulars:

• professional software developer, work from home - typically Enterprise mobile apps and backend
• Small, 900 sq ft apartment, office (guest bedroom) is right in the middle of it, no (indoor) coverage issues.
• security is a concern, as I have an obligation safeguard client's work and data. I've considered, e.g. a Netgate appliance in front of the Internet connection
• I do like having hands-on configurability, prefer using open-source software (have used OpenWrt on a different router in the past, and really prefer it to Merlin - e.g. plugins that have their own UI - but... it seems it doesn't really properly support full performance on recent radios, because OpenWrt won't use closed-source code and manufactures have withheld necessary details to write open source)
• But on the other hand, that's a lot of work!
• I would LOVE to be able to configure VLANs over WiFi. Is that possible? For example, my Nest has no business connecting to my Mac Mini, nor to my Denon receiver, etc.
• VERY crowded RF environment. Edge of downtown San Diego, high-rise housing, offices, hotels nearby/across the street, near Lindbergh Field (not sure if some 5gHz channels are blocked-out, they were at a previous residence closer to the airport), San Diego harbor, heavy military presence, etc. etc. etc.
• I WOULD like better 2.4gHz coverage. There's a nice common outdoor deck one floor down, I'd like better coverage there.
• 1 gbps symmetrical Internet (Webpass/Google Fibre). Shared with 85 apartments, but outside of peak viewing hours, (and during my working hours) I typically actually do get 800-900mbps to speed test nodes on wired connections.
• Despite above, I do not require the ultimate WiFi speeds. I typically get 300-400mbps to the net over 5gHz wifi, and this is more than good enough for me plopped on the sofa reading on iPad. In the distant past, it might have bothered me that I can't get the same 800-900mbps that I get wired. IDC. I get the speed where I need the speed. (Desktop.)
• Really, my WiFi needs are only for devices that cannot be wired - I read documentation/browse on an iPad, typical home iPhone use, various iOS/Android test devices, typical home iOT devices (Nest, Google Home, etc.)
• If it can be wired, it is wired. So, for example, I run a CAT6 to home entertainment center and have a little switch hidden there.
• I have an OLD 16-port D-Link "Web Smart Switch". I've had hardware trouble with it in the past, but seems not to be acting up lately. It will never get another firmware update, but for now, I can configure it if I use Firefox. (Won't work with other browsers!)
• I have some limited static VLAN setup on the switch. One 2-port that passes the incoming Cat6 from WebPass to the Asus router. One "monitor" static VLAN. This can be configured to echo data from any port. The idea is I can plug in a notebook running a packet sniffer, and configure the switch to give me data from any single (wired) device or else the Internet connection. I have OCCASIONALLY done this to diagnose e.g. network issues in software I'm developing.
• Most consumer routers are ugly. This is not an opinion, this is FACT! I would rather not have ugly, but will tolerate it.

I wonder if I should be looking at something like Ubiquiti? What is the MINIMUM I need to get started? Could I start with just a nano AP and security appliance? Will I be happy with the security appliance, or given my urge to fiddle, is a Netgate (or other pfSense box) inevitable? I know the old switch will have to go some day, and the Ubiquiti switch seems attractive. (But imagine there are equivalent choices at lower cost, albeit without nice integration with the Ubiquiti environment.)

Was just going to pull the trigger on the RT-AX88, but had last-minute remorse. Thought I'd ask the experts and give it a couple of days of thought.