Why do multi-function devices (switch + router + firewall in one box) carry a particular risk for a perimeter?

The more functions one device combines, the bigger the damage that a single misconfiguration or a successful attack on its management interface can do.

Modern network devices often combine Layer 2 switch, Layer 3 switch/router, firewall and more. Small examples are home routers like the Fritz!Box with limited functions; large ones are modular enterprise families such as Cisco Catalyst. They are convenient and cheap to run, but they concentrate the whole perimeter in one place: whoever controls the management interface can rewire the VLANs, change the routing and rewrite the firewall rules. With separate devices, an attacker or a mistake would have to hit several boxes to open the same hole.