For starters, make sure that if you get a third party modem/router you get an approved device since you'll be up a creek if you want Comcast to acknowledge that you have an Internet outage because of them. Their support page gives some tips on selecting an approved one. Supposedly there's an Amazon page that has a bunch of approved modems/routers as well, but I don't know how outdated it is.
I personally use the rented modem/router (I live in a rural area, so there are no other xfinity hotspots to leech off of when my monthly cap is used up) in bridge mode and use a Linux-based PC for my router/firewall. You can get a residential router and just use that, but odds are pretty good that when a new model comes out the firmware updates will stop coming, leaving it vulnerable to new security exploits. Vendors have also historically been pretty slow at creating and distributing firmware updates, while with some Linux distributions you can set up automatic/unattended updates. There is also at least one case of backdoored firmware, such as D-Link's DIR-620 router (casual Google search also shows up many similar cases of easily exploited base firmware).
There was a comment in that link you posted about WPA3 as well. If it requires hardware support, you will not have access to it when it finally is released and will be stuck with WPA2. Updating a custom router would only require purchasing a new wireless adapter that is compatible with WPA3 (again, if there are hardware requirements for it).
If you do end up purchasing a router/modem combo you will want to go and disable things like WPS and UPnP port forwarding, and probably other quality of life "enhancements" since they're bad for security.