I’m quite happy with the openreach setup in the UK - using a very simple ONT and whatever you want going into it router wise. They’re very close to just being a media converter, and the ONT SFPs are basically the same thing in a different form factor. I understand why they’re controlled given the topology of gPON.

If you’re worried about security of the device on the WAN side, then you’ve got bigger issues.