Modems and static IP addresses

I was informed by my MSP (Sparklight) that if I want to use static IP addresses with my business subscription, that I have to use one of their devices... which are router/firewall/WAP/modem devices:

Can I purchase my own modem and still have a Static IP assigned? 

I found this out after buying a new DOCSIS® 3.1 Cable Modem (CM1200) on Amazon.

I don't really get this.

1. it's a CPE... I should get to run what I want on my side of the demarcation... otherwise, what's the point of having any sort of demarcation at all? Where does it end?  Do I have to get my router, switches, WAPs, NASes, laptops, etc. from the MSP?
2. my employer provides a firewall that they've chosen and provisioned... why do I need to stick another firewall in front of this--it will just cause more problems (e.g. double-NATTing, ISAKMP, STUN, etc).
3. IP is a layer 3 abstraction, so why does my layer 2 device [modem] come into it?
4. by turning off WiFi, firewall, and other [complex] router functions on my hypothetical Arris device, I've effectively turned it into just a modem... but I'm told I can't use just a modem;

so I asked about this, and here's the response I got:

For the security of our architecture we do not allow customers to directly peer with the routing protocols on cable modem or pon based services. The specific reason why is that to maintain the security of our CMTSs and routing protocols so the dynamic routing protocols are on devices under our own control

which I really didn't get, and I've written routing protocol stacks.  A modem wouldn't be peering via a routing protocol with the MSP's infrastructure.  It doesn't have the ability to: it operates at layer 2, and hence can't route anyway, being able to only address other MAC-layer devices that are on the same physical segment.  And I'm not asking to peer at the routing protocol level with their infrastructure.  I'm happy to provision a local address, subnet mask or prefix, and default gateway and call it good.  No routing protocols involved.

Further, a router/firewall/WAP/modem device has more complexity, and hence more attack surface.  It's axiomatic that a service doesn't necessarily need to be enabled to be vulnerable to attack.  Less functionality, less attack surface, hence easier to secure. It's hard to be more secure than a modem.

The CMTS's should be capable of blocking [routing protocol] traffic via ACL's (access control lists), or simply disabling listening on the DOCSIS interfaces at the routing protocol layer.

That Sparklight has to protect their infrastructure by imposing restrictions on the CPE's is concerning to me: what happens when a customer manages to get a rogue device onto their network?  Can it be that easy to compromise their infrastructure?

Does anyone else who knows more about the particulars of DOCSIS have any insight to offer on interpreting the response I got?

Thanks