Love OpenWRT!
As a networking noob I spent more than a week configuring it to get it right, including needing to SSH into it because I flashed the wrong firmware (do not get NA and EU confused, the difference is enough to flat line your modem).
But in the end, I eliminated my bufferbloat with SQM; a feature the stock device lacked. I also set up a USB to act as expanded storage to install more software.
IMO, look into the linuxserver.io fork of NGINX, called SWAG.
It comes preloaded with a bunch of fantastic addons for security.
Quite easy to get set up, if you’ve got an idea about how it works.