In case this helps anyone, I've decided to go with a Firewalla Gold SE as an ethernet-only router (to interface with my ISP's ONT), and TP-Link BE11000 mesh wifi 7 as wireless access points.
The Firewalla is still in transit, but should arrive early next week, so I'll report back. But going through the manual, the power and features are amazing, including built-in ad block and domain filtering. And it'll do dual WAN failover, so I can keep a slow, cheap plan on my cable company's internet service and use that as a backup to my primary fiber provider (Ting, which is fast but unfortunately has periodic outages lasting from like 5 - 60 minutes in my area -- too much construction, I think).
As for the TP-Link BE11000, I took a chance and picked up a Costo $399 special deal on three satellites. It's been remarkably stable so far, and the wifi 6E speeds are impressive, getting >800Mbit/sec over wifi consistently. I don't have any wifi 7 devices yet, but nice to know it's future proofed there, even if my ISP doesn't offer anything over 1GB/sec presently. At least LAN traffic won't get bottlenecked. I'll just need to upgrade the big 24-port switch in my network closet from 1Gb to 2.5Gb when the time comes.
The TP-Link system seemingly has more useful features as compared to the Orbi, such as being able to have certain devices preferentially use a specific satellite and/or a specific frequency (2.4GHz vs. 5GHz, for example). Handy for some of my further away IoT devices, like one particular security camera that I have, that tries to connect to 5GHz, only to drop, pause, then connect to 2.4GHz, then to try again to roll up to 5GHz, drop, repeat.... The TP-Link app can assign a device to a specific access point and restrict it to 2.4GHz only, seemingly enhancing its stability. Still testing it out, but appears to be a significant improvement over the Orbi in both speed consistency and stability (and price, TBH).