True for most of us(!) but … specifying your threat model includes an assessment of who your threat actors are, what their level of sophistication is, what their level of desperation is, what their motivation is, what they might be after / what you are protecting, what they might already have access to - and, related to all that, whether it is a targeted attack or an untargeted attack.
I review my logs. I see hundreds of attacks every day. It is my judgement that they are untargeted. There would be a wide range of actors, with a wide range of sophistication. Anything from a script kiddy to someone informally acting on behalf of a foreign nation state, to someone literally acting on behalf of a foreign nation state.
It is my judgement that their desperation level is low (i.e. probe and if unsuccessful, move on - because there’s always an easier target on the next IP address) and my security practices encourage that (e.g. temporary source IP address block against some unsuccessful attacks and e.g. correlate similar unsuccessful attacks that aren’t blocked by IP address).
Could I be doing more? Of course. But right now my threat level is not so severe.
Let’s say that you retain your old router and actually use it, and disable routing by not connecting the WAN side and disable switching by only connecting one LAN port and use it only as an extra, live wireless access point. Let’s say that there is a security flaw in the WAP functionality that is being exploited in the wild but which will never be fixed.
You can be attacked by anyone within WiFi signal range (which for most people would be a non-empty set) and it may not require a great deal of sophistication or desperation. The opportunistic wardriver could pick it up.
Now compare that with an alternative config where the old router has routing and WAP disabled and is being used solely as a switch i.e. to get a few more ethernet ports, and there is an unpatched known vulnerability in the switch functionality.
Realistically that is more difficult to exploit, requiring greater sophistication, because it probably requires a blended attack (one attack, a different attack, to get access to the local network and then the specified attack against the switch) or it requires physical access to the premises - and the vulnerability at your house is not readily detectable in the first place.
)
