I'm pretty sure they get the firmware from whoever makes the WiFi chipset they are using in their routers.I actually tried to offer help (but with the caveat I'm not a programmer by trade). I was informed by a friend at ASUS that they get their firmware direct from Broadcom, implying that at least WiFi implementation is proprietary, (or I'm under qualified, the nice way of putting it)...
I agree the SDK is not gonna be a "blackbox" as you note. But what they program into the firmware...
Even ASUS' Game Radar was sending pings out (by default) on all but the most recent firmwares...
Certainly, with newish chipsets, the vendors haven't merged the drivers into the upstream Linux kernel yet and probably won't for quite a while.
The vendor binary only bits are usually the WiFi drivers perhaps some other bits but not too much.
Then, as you say, there's the customization that the clients (ASUS) will do, AiMesh, Game Radar, etc.
You can see several iterations of the SDK that ASUS uses and what they value add (often binary only bits) in the github.com repository Merlin uses for his work.