Great article as always remlaps :)
Quick question though, even if the packers from the device to the router are completely visible to anyone eavesdropping or even changing the packers in midair, wouldn't TLS encryption from the device to the server take up the security instead (and very well). It's about the same security risk as using public wifi if that's the case, a VPN + TLS (https on website url's) would more than cover it.

Please correct me if I'm wrong though