2) There's a panopoly of devices that don't expose the machines to any of these vectors that runs $50-150 provided by vendors such as Zoom and Cradlepoint (in fact, it's what I use since it allows the LTE dongle (that doesn't have these "risks" by the way...) be able to switch between 3G and 4G seamlessly (Linux supports both, but NetworkManager doesn't support switching gears between the differing ways both modes are accessed yet...). The devices either have their own battery or not but allow multiple (more than a MiFi type device does...) devices on the connection.
Svartalf, what device are you using? Thanks!!
Lead me not into temptation... I can find it myself.