In theory it shouldn't need anything in the router apart from understanding IPv6, broadcasting the relevant magic to the local network and establishing a default route to the outside. The equivalent of the NAT 'firewall' that you get for free with IPv4 is the fact that the router firewall should be configured to drop any packets not associated with a connection set up by the local network. That stops all bad stuff coming in unless the user explicitly configures a rule. It's on a par with doing port forwarding under NAT with no other restrictions in place (so internal users can talk to any external address and port).
I find OpenWRT to be just fine for this stuff, although admittedly it's not consumer software (but that style of port-opening interface could be).