I have yet to find a security issue with it. I know German ISPs misconfigured their management network at some point, letting the Fritz!Boxes access each other, but that would've happened with any managed modem that was misconfigured like that.

I bought my Fritz!Box. My ISP has no control over it. TR-069 and other upstream management protocols have been disabled completely.

So far, I'm easily getting gigabit+ speeds across both IPv4 and IPv6. VPN is too much to ask (beyond emergency LAN access, I suppose) but that's what the home server is for.

The web UI is kind of nice, actually. Maybe not to everyone's taste, but the firewall management is a lot less of a clusterfuck than trying to properly configure simple port redirects over the command line. Heaps better than OpenWRT in my opinion. I've run my own Debian router box for a few years and I can say I'm doing just fine without.