It depends.. If you use NAT for a localised internet breakout, then I would suggest using a firewall. If you just plug the internet circuit into the router, have the interface be part of VPN 0 (Underlay), use it only to terminate the DTLS/BFD tunnels, then it "should be" secure. Just disable SSH, ICMP, etc on that interface. It's supposed to be a hardened interface, and they keep track of the packet based on the TCP sequence numbers which limits they chances of anyone hijacking the session / man-in-the-middle.
Double-check with your Cisco reps though and share your findings. It's been a while since I looked into the details around this.
