DD-WRT doesn't upgrade the Linux kernel in the device you flash it to - this is what enables it to use the closed-source drivers that A) require a specific Linux kernel version and B) are typically a Broadcom thing. You're still getting a more stable and performant device in most cases but not necessarily a more secure one or one with newer kernel features. So I prefer OpenWRT and devices that allow OpenWRT to fully work.

> I would buy a low-power SFF PC with dual NICs, run OPNsense or OpenWrt, and use the wireless routers strictly as access points.

If you can fish an old PC with a few GB of RAM made since 2006 or so out of the trash, you're halfway there. Get a cheap 32GB SSD and a second PCIe NIC off of Amazon, and go for it. You can run OpenWRT on x86.