openwrt uses linux kernel that is very near latest (LTS) release. they kinda have to do this for support added for new devices and new wifi standard and so on.
a company that supports its own limited product range doesn’t need newest kernel that much. because contrary to popular belief most kernel changes are not security related. and their devices don’t change hardware wise.
but having said all of that if I were you and my device was supported by openwrt, I would probably migrate to openwrt and be free of a small company limited support.
generally yes. but we are talking about a public network facing device that is usually the first line of defense against wide Net.
that needs to be updated for new threats. those threats are not as extensive as 20 years ago (a lot of stuff are way better) but there are still bugs that appear in router as seen by news about routers hack that sometimes pop up.