At a minimum, the user would be able to see all packets on the network. Also consider that the user could introduce network software completely foreign to the network to breach security from a trusted host on the internal network. I won't go into the maintenance and administrative headaches involved when uncontrolled physical access is given to such PCs, but from the single point of view of network security, firewalls can permit an almost unconstrained access to services available on low-security perimeter networks without compromising existing internal services. Setting up and configuring bastion hosts to provide the services and security can be complicated from a software, not a hardware, standpoint. The hosts themselves do not have to be exceptionally powerful or complex.
Routers tend to filter packets in a straightforward manner.
In the main, UNIX has proven to be the operating system of choice for bastion hosts. There seems to be little difference between vendors when basic networking capabilities are needed, and there is a plentiful supply of free software available to supplement the basic security utilities included in all current UNIX versions. This proxying package is relatively easy to use and is very effective for TCP-based client requests. As a use for older PCs, the KarlBridge software package authored by Doug Karl can convert a PC with two Ethernet cards into a packet filtering bridge. Unless very heavy traffic is expected, the slower CPU speeds of x486 chips can easily manage the load if adequate memory is available.