This one appears to be a good deal right now:

https://www.gl-inet.com/products/gl-mt6000/

The stock OS is based on #OpenWrt and reflashing vanilla OpenWrt is super easy.

There's also the fully open hardware #TurrisOmina which comes with #TurrisOS based on OpenWrt but can be pretty expensive unless you're in Europe.

About #OPNsense, I heard on a #cybersecurity or perhaps a #selfhosting podcast that their #openssl package is pinned to an end-of-life version which lacks critical security patches. I haven't verified this myself though.