But what if you don't want to tinker? I switched to OPNsense as a direct replacement for our Asus "WiFi routers", and it has been phenomenal, reliable, and does everything needed - when you just want it to work, it really just does. But when you want more advanced functions, there are tons of plugins and stuff that you can run natively, while still having a true CLI.

I suppose it comes down to what you said - "if you intend to run other stuff on the same hardware." Is it a good idea to run all sorts of extra stuff on your literal firewall/router? And if you did, I'd assume using a hypervisor is safer anyway? That way you can have the GUI and reliability of OPNsense but have a Linux distro beside it.

You also said that Linux has much better performance vs BSD, which seems rather far fetched. Got any data for that?

One other thing: OPNsense comes with a ton of helpful rules to eliminate bot traffic, allow IPv6, different NATs, VLANS, etc which you'd have to add manually. Not the end of the world, but worth considering.