A big question would be what 'at scale' actually means to you. Managing router + 3-4 APs in a typical home is quite different than interacting with site2site VPNs across multiple branch offices or a university-like campus network.
For home network, the advice would be centralize all policy making to the central router - and dumbing switches/ APs down to the extent possible (making them blindly execute the router's decisions/ passing through VLANs to the desired targets). That way your focus can be on the router, the rest of the network will just follow its lead (or not work, which will be easy to fix).
I strongly advise against overcomplicating the situation for yourself on a home network, if you don't need to.
Good point - scale definitely changes the problem quite a bit.
I was thinking more in terms of multi-site or fleet scenarios (dozens to hundreds of devices), where you have different roles (routers, APs, gateways) and changes need to be applied incrementally rather than rebuilding everything each time.
In smaller/home setups, centralizing on a single router makes a lot of sense as you mentioned.
But once things are more distributed, it feels like keeping state consistent over time becomes the harder part than just pushing config.
Curious how you’d approach that in larger deployments?