How can you trust that a closed source OpenBSD fork is secure when there's no way to audit the quality (or lack thereof) in the firmware the vendor gives you?

If it's GPL you can at least interrogate the code release and make an informed decision