Should I buy a Hardware Firewall for my Time Capsule 4th Gen Router?
Is it advisable for me to buy a Hardware Firewall to complement the Time Capsule for security reasons – especially when having some IOT devices?

Yes.  Absolutely.  Unequivocally Yes.
Threats have evolved significantly since 2011 when that Time Capsule came out and quite frankly, are woefully ill-equipped to deal with the current threats.
I don't use &quot;retail/consumer grade&quot; routers that you get at your local big box house.  I use pfSense running on a USFF Dell machine (Core 2 Duo, 8GB RAM and 32GB SSD) configured with an Intel Quad Gig interface.  The total cost was under $150 (the quad gig adapter was the most expensive part).

I can drop traffic from certain global regions (i.e. China, Russia, India, etc.). Any traffic that originates in a particular area is literally dropped.

I can add on any number of enhancements to my router

Run my own VPN
Add my on SSL certificates
Add DNS whitelists/blacklists (pfBlockerNG)
Install a Squid caching Proxy
Configure High Availability with cellular fail over



There's a cornucopia of features you can add to this type of router to customize the level of protection you need.
Such overkill!
Yes, there's a ton of features, many of which you'd probably never need unless you were setting this up for a corporate entity.  However, what's important about having a hardware firewall is that

being hardware, it's performance is that much greater.  The more hardware you throw at it, the better it works
Stateful Packet Inspection.  This is a technology that analyses the &quot;context&quot; of each packet and whether to allow it or to block it.  Your TC is stateless meaning it will either allow or disallow based on a simple rule.  This also requires CPU cycles

Is it really overkill?
IMO, no, it's not.  You can start with a cheap PC you pick up on eBay, Craigslist, Gumtree, etc.  For home, it doesn't need to be fancy.  2GB RAM is more than enough but the more RAM, the more &quot;states&quot; the router can handle.  You'll need a NIC since the computer will come with one, you just need another (one for WAN the other for LAN).  I found (on eBay) SSDs used in thin clients and bought 5 for under $40 (good to have extras on hand).  Spend about an hour putting it together and going through the setup and you'll have an enterprise grade hardware based firewall protecting your network.
TL;DR
Yes.  You absolutley need one.  Whether you build it yourself (I like pfSense or you purchase one (go for a &quot;business class&quot; not fancy &quot;consumer grade&quot;) put something capable of handling today's ever evolving threats between the Internet and your network.