I will definitely get rid of anything Asus based on Broadcom and switch to x86 or Mediatek based units.
These are hardly better. Asus is definitely the most opensource-friendly of the bunch, beside rolling out your own router from something like OpenWRT.
Have you considered doing work on / forking another firmware platform? I don't want to name any of them here since I don't want to get banned, but you know which ones I'm talking about.
All the other hardware manufacturers (like Netgear) are flat out hostile to potential third party developers. There's someone on SNBForums who has been doing work on Netgear's firmawre for years, and Netgear has rejected all of his attempts at even talking with him, they have even gone as far as far as removing some portions of the source code from their GPL drops since he started working on his project, making his task even harder. Their whole httpd server is 100% closed source for example, so you can't even implement any new real webui feature.
As for a project such as OpenWRT, I have no interest in getting involved in it as a developper. I would just be random developer number 50, whose main task is to update already existing packages, and argue on a mailing list as to how best to put that new checkbox on the webui. This sound more like a job than a fun hobby to do. My primary reason to work on Asuswrt-Merlin (or any of my previous software projects) is for the fun of doing it as a hobby.
Personally, I think you are making it a mountain out of a non-issue. A lot of the security issues reported there are hard to exploit, obscure corner-cases which, personally, am not feeling worried at all by them. So even if some of these were still present, I am not feeling concerned by any of them. There is no proof-of-concept on how these could be exploited. These days, a lot of security fixes deal with very intricate corner cases that are not really exploitable in the wild. Take their fix regarding code execution in the custom options for instance. To exploit this, you need to have the admin login on the router. Which... already allows you to login over SSH, and directly run anything you'd want. This is an example of a security issue that is more academic than a concrete threat.
When there are real serious security issues, I have always been able to address them quite quickly. The Strongswan security issues recently fixed by Asus for intsance were adressed in Asuswrt-Merlin within like a week of them being disclosed. I have also issued security fixes for SSH or OpenVPN within a very short period of time - shorter than the vast majority of router manufacturers out there. How many router manufacturer beside Asus has issued a fix for the recent dropbear security issues? (I am excluding commercial/proprietary platforms there as these are in a totally different category of products).
While no piece of software is ever totally perfect, I generally consider Asuswrt-Merlin as a whole to be in a good position as it currently is, and I don't feel worried at all in relying on it for my main router.
Just don't believe everything listed on a generic changelog to be a list of critical issues - a lot of listed fixes are actually non-issues for the regular user.
