robotrono

You might want to investigate vopono which allows specific applications to run in a separate network space. This you could for example run Firefox or qbittorrent in a separate virtual network that can only communicate via Mullvad VPN tunnel but not see anything outside it. This is great for desktop use. Another great option is gluetun which allows other docker containers to be bound to a VPN tunnel.

I am pretty happy with a Dynalink WRX36 Wifi 6 AX3600 router which has a 2.5 Gbps capable WAN port and 4 * 1 Gbps ports for LAN. I replaced the vendor firmware with OpenWRT which is working well nowadays, you just have to follow the install instructions closely. It can be had for $79.

https://mullvad.net/en/blog/2023/8/9/response-to-tunnelcrack-vulnerability-disclosure/ is Mullvad's response to this topic. TLDR not a concern other than possibly for IOS.