Everything is connected through it, to the internet. All your devices have the same IP when connecting with the outside. If your ISP has access to it (most common setup unless you have your own router) they can see every bit of traffic going through it (tho they can't decrypt encrypted traffic, there is tons of personal information going through it). The standard insecure router is not difficult to compromise (especially a public one), resulting in compromised networks. A company like Google or Facebook, even without having an account with them, can get a good profile of each member in your household simply through tracking traffic (IP and device foremost). Not mentioning the "deals" they have to obtain or share this data with each other.

A VPN solves a lot of those issues, or at least obscures it, there's still fingerprinting.

Decent ISPs will configure their routers mostly locked down, but some don't at all. It's great if they allow you to configure it yourself lest you know what you're doing.

If you're using it bare naked, don't be surprised your SO's phone or your Smart TV shows ads for stuff you've been searching for in your phone at night alone in the bathroom. Even when none of the services are logged in or from the same company. It's any tracking company's moneymaker.