I see, I thought you weren't intending on running a router based on your earlier post about running two devices not being environmentally friendly. But on principle I agree, more than one port on the ONT should be available.
Worth remembering though, if you could attach another device on a second ONT port (other than a second router) it would effectively be in the DMZ and not protected from the internet by a router firewall, it would also need its own IP address, I don't know if SH would supply two dynamic IP addesses on one service. They also wouldn't be LAN ports as you suggested earlier, rather WAN ports.
Most of the time those all in one devices ( Which acts as a router and ONT ) will be having poor WiFi performance and less options. Starhub itself was providing a home gateway ( Not same as VQ ). After numerous complaints now Starhub is giving a D-Link router with better performance. The Starhub (Same for Red and Orange) ONT does not have routing capability nor WiFi. So it is not just a matter of unblocking the port.
Should be something wrong with your 868. I have one DSL7000. The performance is worse than 850L Starhub gave me (In terms of wireless disconnection rate and speed at longer distance).
I wouldn't say it's insecure per se as it depends on what is attached; but just plugging a laptop into an ONT port is less secure than plugging in a router and plugging the laptop in to that. The reason is that routers come with firewalls and can also be configured to prevent access from the internet of various protocols as well as restricting which ports are open to the internet. A laptop can however have a software firewall installed like ZoneAlarm which will add security to the laptop similar to the hardware firewall on routers. So depends on how you do it.
All in all though if you had more ports open on the ONT you should use a router on them; but why bother really, if you want more LAN ports the best way to do that would be to either add a switch or bridge in another router.