i have my starlink plugged directly into a gl.inet router that runs a wireguard client. all of the clients connect to the gl.inet wifi. absolutely nothing unencrypted goes out the starlink wan.

it works fine.

i have the exact same setup at home with cox cable, because they will data mine the shit out of your traffic (and they have your phone number and home address to link it to). most terrestrial residential isps do this shit. vpn everything.