OpenRouter is likely just leveraging Codex subscriptions.

Wouldn’t that be against TOS?

It might be through a level of indirection via an intermediate provider, offloading the TOS issue to the intermediate provider who couldn't care less.