I use their wifi APs because they make them really easy to configure and manage. But the management interface stays locked in a vlan without access to the internets. Because I don't trust their cloud affinity.

This also disqualifies their routers and firewalls for me. How can I trust a device which tries to phone home? So that area is covered by opnsense on a device with a sufficient amount of Ethernet ports.

Any device with a mass storage can act as a NAS - a single board computer + Linux + samba/ nfs/ scp/ sftp. I heard TrueNAS or OpenMediaVault are recommended as all in one solutions - I don't know them.