That's an excellent question, and not one I've seen rigorously investigated. My own completely subjective opinion (as an infosec type) is that OpenWrt is proba

That's an excellent question, and not one I've seen rigorously investigated. My own completely subjective opinion (as an infosec type) is that OpenWrt is probably better for security than the vendors code since 1) the vendors aren't security companies and have an at-best iffy history with security, 2) OpenWrt releases more often than vendors, so there's a better chance (chance, not guarantee) more bugs are being fixed quicker and 3) platform diversity means OpenWrt code paths are being tested under more conditions that any single vendor does (probably). But that's all subjective and lumps all vendors into the same bucket; likely some are much better than others.