Routers are, internally, computers. They run an operating system (often a Linux or VxWorks derivative), with code. Like any substantial piece of software, they have bugs, some of which being remotely exploitable. However, unlike computers, they are rarely updated, so whatever security holes they have tend to be long-lived. And that's without counting more basic issues like default admin passwords.
While, conceptually, the router can be your firewall and thus any other firewall would be redundant, you would be well-advised to run an additional protection layer, such as a small PC with two ethernet interfaces, acting as a router/firewall, with a Unix-like operating system (some Linux or BSD flavour, for instance). The important point here being maintenance: don't consider the box as an opaque appliance to be installed and then forgotten. You have to check for security updates, preferably daily.
I thus recommend installing another firewall in addition to your SOHO router, not because the router would structurally be bad at firewalling, but because adequate security is reached only if proper system administration is applied, and you cannot really do that with a SOHO router; whereas you can with a PC and an open-source, maintained operating system.
