> any decent firewall (including referee PFsense/OpnSense) support ACLs that follow IPv6 address changes

In the case of pfSense this is a recent change. It was not supported when I migrated away from it less than five years ago.