Too many exploits is not a that big problem. Non of new fancy exploits with cvss 10.0 from 2026 have worked for this ap. If you don't use all the drivers you have small attack surface. I'd say that it's a surviviourship bias. Bsd has less traction => less bugs found

That hasn't been my experience as long as you keep an eye on updates. Luckily openwrt has made this really easy to upgrade when required.