A compromised router could be used to pivot around your network, via port/vulnerability scanning and malicious payload delivery. Additionally changing routes or tunnelling your traffic via an illegitimate VPN, could be possible. This process could be very noisy though.
Personally I would only use port forwarding for the administrator interface on the router to give myself remote access to it. (Presuming I compromised the router via a LAN connection)
I may use also use port forwarding for other interesting services like IP cameras, personal PC's/servers, NAS drives etc, depending on my objectives and the scope of the attack.
I think the most obvious attack would be DNS hijacking, done correctly an attacker could enumerate all of your personal information.
Additional they could set up full packet capture on all of your LAN and internet traffic that passes through that router.