Check the cables for damages, or tight bends, that could cause a lot of packet loss.

I have a “prep script” that takes care of everything.

It takes less than 2 minutes to run on a fresh install and does all kind of fun things.

Don’t use the built in crap.

Get a Raspberry or other tiny computer and set it up as a “smart TV box”.

You say you can’t invest in a solution. But this problem require you to throw money at it to go away.

Why not both?

Wireguard doesn’t answer unless you hand shake with a valid package.

There are three 512 bit keys.

And you can put ssh behind it with ssh keys.

The extra later of defence is quite significant.

No “actual user” is blocked by fail2ban. They auth with keys, can’t really fail.

Blocking after three fail is very reasonable and effective. It also keeps the logs noise down.

That’s a horrible installation. Send them the picture and ask them to remedy ASAP.