Block the ISP DNS and use your own on the router level.
You could look into wireguard or VPN on the router level.
Probably OpenSense.
As long ad your device has a IMEI though not like it matters.
There's probably a million other things you would need too. Make sure your browser doesn't use its own DNS, eg, Firefox + CloudFlare by default.
I assume you could theoretically split traffic up over multiple ISP's making it a PITA to try to make sense of.
Also obviously separate trusted & untrusted devices, WiFi and wired into separate networks.
I think your best bet is to assume that everything you don't control is a vector.
The modems run binary blobs you don't control.
A standard modem with a singular hookup to a router is as good as it gets. Maybe you are contemplating the modem as a combo -- if it is also a router and wifi, you can bet the ISP sees that as "Their Network" and not "Your Network" and any WiFi capabilities could be used to reverse hack insecure devices theoretically like smart TV or IoT.
You could put the modem router combo in a Faraday cage to dampen the signal theoretically.
That may not be answers to the query but I think the smart short answer is: yes, unless verified no.
Edit: to go further, theoretically they can capture any traffic and if they get the encryption key decrypt the traffic.
Or maybe with a quantum computer decrypt with ease. And if you have any leaks or there are backdoors then who knows what the consequences could be, cough cough xz