It’s, as you said, because it mounts everything as root. It’s possible that this could be exploited to gain root privileges but not likely. If you’re paranoid and/or building a secure system that you don’t need to dual boot, it’s not a bad idea to disable it.

While you should probably fix your router, there are some workarounds that can work. If you have your own domain, cloudflare tunnels are really great. Similar option that doesn’t need a domain but requires a VPS or other hosting with a public IP is just a WireGuard tunnel to your service.