I tried Grok to see what if any a hallucinating LLM could bring to this topic.
A workaround would be to create a post-hooks script such as:
/config/scripts/commit/post-hooks.d/50-bulk-routes.sh
Which contains something like:
#!/bin/bash
# Generate full FRR config (or just static section) from your source of truth
cat > /run/frr/config/frr.conf << EOF
! bulk static routes
$(your_script_to_generate_1000_ip_route_lines)
EOF
# Or use vtysh batch / frr-reload
systemctl reload frr # or /usr/lib/frr/frr-reload.py --reload /run/frr/config/frr.conf
# Same for firewall:
# your_script > /etc/nftables/ruleset.nft && nft -f /etc/nftables/ruleset.nft
Basically removing static and dynamic routing and firewalling from the VyOS config itself and instead offload that to its own config-files being loaded by a post-hooks script.
Im guessing a plausible method would be to use your current config and then dump firewall rules using nft into nft.conf and look at generated frr.conf to have a baseline for the above script.
Then remove all this from the VyOS config and just manually alter ntf.conf and frr.conf after that to add/remove stuff.
The obvious drawback with above is lack of input control so what will happen when the nft.conf or frr.conf fails to load completely?
Another workaround was to disable the validators:
find /opt/vyatta/share/vyatta-cfg/templates -name node.def -exec sed -i 's/^syntax:expression:/#syntax:expression:/g' {} +
find /opt/vyatta/share/vyatta-op/templates -name node.def -exec sed -i 's/^syntax:expression:/#syntax:expression:/g' {} +
But then I would rather prefer the first suggestion (the first workaround above makes it more obvious that you are no longer “protected” by the vyos-configd).
Other than above workarounds it suggested following (dunno if its sane or not):
Edit src/conf_mode/protocols_static.py (and firewall.py):
* In generate(): Build the full FRR section (or nft ruleset) once using efficient list comprehensions + '\n'.join() or Jinja2 (already used elsewhere in data/templates). Avoid any per-route string +=.
* In apply(): Replace any per-route vtysh/staticd calls or incremental adds with:
# Example for static (adapt from existing FRR helpers)
write_config_file(full_frr_conf)
run(["/usr/lib/frr/frr-reload.py", "--reload", config_file]) # or systemctl reload frr / frr-reload
* Same pattern for firewall: single nft -f on the generated ruleset.
* Rebuild/install the vyos-1x package (or test in a container). This eliminates the per-item apply overhead.
The apply phase in protocols_static.py already has some cost even with few routes — batching removes the scaling problem.
* For boot: Enable squashfs optimizations in kernel config (CONFIG_SQUASHFS_FILE_DIRECT, larger fragment cache) — small win but easy.
* Consider overlayfs instead of unionfs-fuse for config sessions (advanced, discussed in T5388).
And finally as already mentioned 
Long-term: The VyOS project needs to finish the config backend refactor (T6209) and enforce batching in all high-volume conf_mode scripts. You can contribute a PR against protocols_static.py + firewall.py + vyos-configd handling — the manual FRR/nft timings prove it's achievable in 1–2s.