Doing routing/firewall in software is a lot more flexible, and easier to patch when vulnerabilities come out. Keep in mind those edgerouters look like they have dual core embedded MIPS CPUs. My dell power edge is a full blown rack-mount server that could run your plex instance.

That’s what makes up for the lack of dedicated asics.

As for the four NICs they are as follows:

1gb - wan (to modem) 1gb - config (to config vlan on switch) 10gbps - main lan trunk to LAN switch 10gbps - trunk line to public server VM host (DMZ’d from rest of lan, each VM has its own vlan/subnet/firewall ruleset)

They don’t act as a switch because it handles packets, not frames, allowing/dropping/denying them based on rules set in software.