The router does have a firewall but it blocks everything inbound by default. Some routers (at least mine) do not offer the granularity to filter traffic for certain devices (no NAT either). It’s either allow all in or nothing.
When you enable IPv6 and switch off the firewall (since you can’t host anything otherwise), every device becomes exposed to the internet.
Then unless the devices have a firewall themselves, all is exposed. Not just the web services, ssh and the rest as well.
They mostly use inline JavaScript to determine if the dev tools are open. If open, then they put you in a loop that will only end of the tools are closed. Normally when this happens the debugger will “pause” at the line in question.
If you know how to use the “unlock origin” extension, you can then block the JavaScript inline function so it won’t run. Then the page will not stop when the dev tools are open.
You can Google how to block inline JavaScript with ublock origin.
There was a way around it however but not something everyone will be able to do with their home router. I had to ssh to the router using ISP admin credentials leaked on the internet, then create a file in init.d that loads a custom iptables file with the firewall rules I needed for IPv6. NAT for IPv6 however was not supported by the kennel used for my router.