You don’t know what your ISP-provided router does exactly. It may let some traffic through from the outside. It may get an over-the-air firmware update or config change at any time from your ISP. It definitely has well-known, unfixed vulnerabilities.
Also, if you rely on NAT, you have to have 100% trust in all devices that are inside your network.
What did it say?
I’ve had users who legitimately did not understand this question.
“What do you mean, what did it say? I clicked on it but it still didn’t work.”
Then you set up an appointment to remote in, ask them to show you what they tried to do, and when the error message appears, they instantly close it and say “See, it still doesn’t work. What do we even pay you for?”
I’ve had remote sessions where this was repeated multiple times, even after telling them specifically not to close the message. It’s an instinctive reflex.
To be fair, there wouldn’t be a difference between driving with eclipse glasses and driving with your eyes closed.