For folks who fall in the "more paranoid" category, and want a nice package: https://www.gl-inet.com/products/gl-mifi/

This little fella hangs an lte modem off a qca wisoc via usb (on a mini pcie slot). The stock modem is a little spotty, but is trivially replaced.

They ship with a fork of OpenWRT, or you can use an official OpenWRT build on it. When I find a few free hours, I'm hoping to put together a set of Buildroot configs as well.