For something really small the ubiquiti edgerouter devices which run their EdgeOS are a good choice. If there's a serious security vulnerability on the WAN-facing interface it will be patched. They run a fork of Vyatta. Ubiquiti employs most of the old Vyatta development team, who did not go to Brocade when Vyatta was acquired.
Or build a really small low power x86 system with a few Intel gigabit NICs in it and run open source VyOS.
Or build a really small low power x86 system with a few Intel gigabit NICs in it and run open source VyOS.