As long as your device accesses Internet through Pico-UTM, it is protected by Pico-UTM. In the other words, if the upward (to Internet) or downward (from Internet) packet goes through Pico-UTM, the packet would be inspected and your device would be protected.

Note: If the ISP provides you a modem router, combined with modem, router or even Wi-Fi AP, all devices directly connected to the modem router would not be protected, since these devices does not access Internet “through” Pico-UTM. In order to be protected, you would need to add another router or Wi-Fi AP at the LAN port of Pico-UTM as shown in the following figure: