Listen up, kids - be aware that Netgear routers and such, even the high end ones like the Orbi 750 I just bought, do NOT come with a built-in firewall. You have to pay a yearly sub for their AppArmor service (which is BitDefender under the covers) unless you want to muck around with chaining a firewall device to protect your inbound network. [EDIT: Otherwise, your only protection is the standard NAT behavior.]
Nowhere in any of the documentation or product reviews (that I saw, at least) was I warned that the AppArmor sub was required if I wanted inbound firewall protection to my network.
Don't get soaked for more money like I just did, kids. Save yourself the frustration.