> No matter what you’re doing you have to trust that your home router doesn’t have an externally accessible SSH port with no password set.

No, you don't have to trust. I build my own routers precisely because I don't.

Pretty sure that just means that we trust Linux/Openwrt and the chip vendors.

Linux and OpenWrt have an incredibly good security record compared to what ships on typical consumer devices.