> Let me see if I can nail down the argument here:

Wrong nail. My home router runs OpenWRT. While it's not a 100% guarantee to be safe, it's a lot better than any closed-sourced firmware.

That said, if the choice is limited to closed-sourced firmware options, it's best to choose a reputable brand, so that the list of people who can access your router is limited to three letter agencies (US and China), as opposed to random scammers, like with all these malware-ridden Android phones from Aliexpress: https://www.cnet.com/tech/mobile/android-malware-that-comes-...

So, yes. Not buying network equipment on Aliexpress is a sound advice.