I haven't done a code review so I can't answer that question with facts. I do think however, that anything that bootstraps a FLOSS framework like openwrt could easily be a risk to privacy.

You use privacy and security interchangeably here. They are not the same.

The biggest issue most people have with it is the dynamic DNS feature, which is automatically enabled and contacts their server to create the record. If you turn this off before connecting the router to the internet, you're probably good.

The simplified DoH client also only allows either Cloudflare or NextDNS, which aren't the most privacy-oriented options. Still, it's possible to set up your own.

Otherwise I've never heard of anything major; the devices are cheap and reliable. I've had one running constantly for years and only had to reboot it manually once.