For wifi what you can do to break free from the proprietary black box "mesh" networks is to build it youself using openwrt. I'd only recommend it if you find learning networking fun, not a chore, as it takes some fiddling.
https://openwrt.org/docs/guide-user/network/wifi/roaming

Having a pfsense between your LAN and the ISP means the ISP won't know as much about your LAN devices, they are usually the true admin of the ISP router and can see what it sees.

I imagine you've run factory reset on the switches you bought second hand, should be enough.

Bonus: If you want to break ip cameras free check out https://thingino.com/ and https://frigate.video/

Ahh, another cultured person. The only thing you'll get out of having a pfSense or Open sense box is a better firewall. If you want to properly segment your network with vlans and what can talk to what. My setup sounds like the same as yours. ISP box in bridge mode > Asus RT-AX86 (stock firmware cause I've been lazy) > pi-hole > network. I have a little Asus travel router in the garage in mesh mode.

I have two avenues to travel for an upgrade. I could grab on of those N100 boxes that they have on Amazon with the dual NIC and throw pfSense on it and AP mode the Asus router or I can spend money, cause I like nice things and grab a Ubiquity UDMpro and one of there PoE switches, cause I like PoE, and then throw the Asus stuff in AP mode.

I personally like Ubiquity cause it isn't Chineseium or Cisco with their shitty patching. Both options also give me experience messing around with industry standard firewalls (for the job experience). It really comes down to if you wanna stick with open source or not.

Sorry, I don't understand your Ethernet cable from the fiber box to router question.

I also have one of those USB NICs, never tried it like that though. I'd assume it'll work. Only one way to fins out.

I haven't meshed with many straight APs that aren't Ubiquity. The have a network controller app that has a webpage that let's you set them all up. I'm surprised your WiFi router doesn't have an AP mode.

Buying used is good, just factory reset everything you get. Keep that stuff out of the landfill.

If you are worried about the security of the brand name WiFi router, i would just try to set up pfsense on a stick(need only one NIC). I am pretty sure i have seen an official guide for that.

So basically, you plug your switch (access port) to the isp router, and plug the pfsense box into another port(trunk port) on your switch. Define a vlan for internet, and have that access port tagged with the same vlan. Then turn off routing in your brand name router and use it as a pure access point. Now you can play with vlans as much as you want

I wouldn't worry about the isp router, it has no access to your network, and most traffic going through it should be encrypted anyway. And for your brand named access points, you can block them from accessing internet.

Edit: The guide: Official documentation for "router on a stick"