Surprise! Routers for years (decade+) used NAT. That meant even without a firewall NAT already provided a natural firewall since unsolicited connections were simply dropped.
NAT, and more is on the web so I'll stop here.
As to the WAN login, you can configure it to allow that so YOUR CHOICE!
As to malware/spy software it's complicated. Some routers offer plugins, some don't. So you have to ask about not only your router but it's installed router firmware or OS.
There's little to be gained by installing antispyware in the router in most countries as here in the USA/NSA, the internet is monitored. Read https://en.wikipedia.org/wiki/Lavabit to learn why it went out of business as they refused to install our government mandated spy gear.
hello experts,
does the fire wall in the Belkin router protect against hacking from outside (WAN) ? Can someone from the WAN login to the router ? Could he install MALware/Spy-software in the router ?

Chowhound
Comic Vine
GameFAQs
GameSpot
Giant Bomb
TechRepublic