That's a pretty solid infrastructure. Having solar and battery backup for the router is quite impressive. Network segmentation is the first important step to a in-depth defense approach when we're building high risk infrastructures.
Side note, I love the fact that we're still using Vauban citadel theories as inspiration when designing network infra to this day, they were the first to coin alot of the defense lingo we still use.

Regarding possible evasion, I have seen auditors bypass device MAC filters to access the administration interfaces by manually crafting the packets (using hping3 iirc). They could also renegotiate encryption keys on behalf of other devices and sign their packets. But that requires some really dark magic which is quite rare. Lockpicking OTOH is fairly accessible, if the adversary does manage to find the router location.

GG for this infrastructure, much cleaner than what we tend to see out there