For nearly all threat models you need to have both FOSS OSes AND a FOSS router. I'm just pushing back on the claim that the router is most important.