Surely, one of you fine folks has a better solution to attach a spare fan to an ISP gateway without damaging it?

depends on what you mean by "do anything". I've managed to shed several ms of latency by doing a modem delete.

My two favorite stories of this were for the local DSL/fiber provider here in Canada, Bell. They use vDSL2, and GPON/XGS-PON respectively. In the former case, I set up a node at my house, which was a Cisco ISR router, with a vDSL2 EHWIC card installed; after some work, I managed to get the unit dialing into the internet via PPPoE, and I managed to drop about 5-10ms of latency simply by removing the ISP provided garbage. It was also clean... a single phone cable plugged directly into the router, and out the other side was a switch, which provided all the network connections I required.... my setup was a tiny bit more complicated than I'm explaining, but the other details don't really matter (long story short, I was operating on a Bell line through a wholesale client (third party ISP using Bell's "last mile"), and they provided me with a /29 subnet for internet routing - the Cisco handled the WAN to WAN communication, and on my /29, I had a few devices including my primary firewall, which was between me and the internet, that then broke out onto a switch for everything to connect to.... a bit more than the average joe can handle, but I work in networking). The other story is about their GPON; I managed to figure out that their GPON interface is almost entirely unprotected, and worked with a G-010S-A (a fairly common design from Nokia, but has variants from other major vendors that are largely the same), so by buying or otherwise obtaining one, and programming it very specifically, you can actually plug the SFP GPON module directly into a router, and with some clever configuring, get your PPPoE to work across it without too much trouble. There's plenty of info about it online if you want to see more.

The only sad story I have about this is that Bell started to release a new modem that has a built in fiber module (no longer using the G-010S-A), which is compatible with both the GPON and XGS-PON systems; I have yet to find an XGS-PON version of the G-010S-A that I can use for the purpose. A friend of mine, whom I did a modem delete for with the G-010S-A, was in an area that was originally served by GPON, so the solution worked. After some time though, Bell implemented XGS-PON in his area, and actually removed compatibility for the GPON, so the solution stopped working. Until I find an XGS-PON equivalent to the G-010S-A, I'm at an impasse. In the interim, my friend has put his modem back in-line, and IIRC put it into bridged mode, which is second best to a modem delete.

I'm a network technician/engineer as my dayjob, so working with this stuff is entirely in my wheel house, I can usually give useful advice for anyone wanting to walk in my shoes to delete their modem, and make it simple enough that it doesn't require my level of skill to maintain (like in the case of my friend), and advice/strategies about how to handle the ISP.

CG-NAT is entirely in the ISP hands, I cannot touch their fancy CG-NAT engine or route around it. My best advice for anyone facing down CG-NAT, is to use IPv6, if your ISP supports it. Simply put, the best argument I've seen for IPv6 adoption is CG-NAT. NAT itself was bad enough, but CG-NAT is a whole new level of evil; it breaks so many things. IPv6 takes you back to the old days of globally routable addresses, end-to-end, completely eliminating the need for any kind of NAT. A large portion of the internet uses/supports IPv6 already, pretty much all the major data carriers support it and actively use it for their own gear (people like google, facebook, apple, microsoft, cloudflare, etc). IPv6 shouldn't be feared, as an end user, the whole thing is going to behave exactly as you expect it to. The trick is: getting it up and working on your LAN, once you can work that out, you're laughing.

Likely won't change CG-NAT config, the new modem would still have to get its IP address from the attached ISP

It's very situationally dependent. In many cases though, the only thing restricting you is the ISP not giving you the information to do it yourself, and sometimes, just sometimes, some kind of code or MAC address that limits what devices can operate on their network; though that's usually set up for billing.

If you use any kind of PPPoE, the MAC address problem usually isn't a thing; this is normally DSL/Fiber..... not all fiber, just some. PPPoE needs authentication which usually means username and password login to do AAA for the client, because of this, there's little to no security on the last mile. All these technologies are based on standards. Fiber is usually GPON, DSL has several standards, but modern DSL is usually vDSL or vDSL2, or some variant thereof, and Cable is generally DOCSIS 3 or 3.1. There are exceptions, but they're not common.

The key is to find which specific technology the ISP is using, and find alternatives. In the case of DSL, it's generally finding a DSL modem that uses the same profiles and annex as the provided modem; beyond that, plug it in and authenticate with PPPoE. Many PPPoE type providers use a circuit number and/or VLAN, so that generally needs to be set along-side the PPPoE credentials.

For DOCSIS, it's a bit sticky, since I know of many cable providers who authenticate endpoints based on the MAC address of the modem; in which case, you not only need to find a modem that can support the protocols in use, and the channel widths (eg. DOCSIS 3.1 16x8), but also one that you can modify the ISP-facing MAC address on the DOCSIS interface to match the one they gave you.

For Fiber, things can be sticky, but often aren't. The ISP can, but often doesn't filter on all of the following: MAC, SN, SLID. All of these values are sent to the OLT (ISP side of the fiber), and it could fail on any one of them. For me, I've had success with the G-010S-A SFP module, and if you look around the internet, you can find a git repo that actually has all the commands to modify any/all of these values to match them to whatever the ISP provided to you. The most difficult is getting the SLID, since it's not published on the outside of the modem. I managed to get my local GPON's SLID from a G-010S-A module that I hijacked from a working modem; in that case it was a string of all zeros.

The information is out there if you look hard enough, and with a little bit of cleverness and ingenuity, you can usually find anything that's missing.

I work in Networking (aka network engineering, aka a bunch of other titles), so this all comes very naturally to me; to give you some examples, one DSL modem delete I did for myself was to pick up an EHWIC-VA-DSL-M for a Cisco ISR router, after some configuration magic, which I won't get into here, I was able to get it to connect to my ISPs DSL line, after a bit more configuration magic, the Cisco was handling all of the traffic from my network to the DSL. It was a very clean setup, only requiring a single phone line from the wall plugged into a module on the router, then on the other side of it (over ethernet) was my network. That's a fairly advanced one, but I'm pretty proud of it. Another case was a friend on the same last-mile provider in my country, on a fiber line, where I removed the garbage modem they gave him and replaced it with a G-010S-A GPON to SFP module, and plugged that more or less directly into the router he owned. In each case, I shaved off a few ms of latency, and bandwidth was largely unaffected. It makes the internet run just that much faster than before, and puts the control in your hands.

Needless to say, the ISPs don't want you doing this, and they don't approve, but in general, you can do so without their involvement and for the most part, they are entirely unaware that it's happened.

Let me know what situation you're in and we can probably devise a solution to the garbage ISP modem issue. Frankly, the fiber modem delete is my favorite.

In the US at least, I haven't heard of a provider not allowing you to bring your own hardware. For example, on Comcast, you can bring your own DOCSIS 3.1 modem that isn't as full of software and doesn't allow neighbors to use an Xfinity public network. Comcast even has a page for compatible devices. Save on stupid rental fees.

https://www.xfinity.com/support/devices/