Many devices include ipsec hardware acceleration, while wireguard ciphers are purely in software. With your typical Ubiquiti or Mikrotik device you can have much more performant connection encrypted with aes+sha than with chacha+poly.

This led to serious vulnerabilities and backdoors.

> while wireguard ciphers are purely in software

This is a feature, not a bug. It's quite difficult to trust commercial routers.

> you can have better performance with ipsec than with wireguard

Citation needed. Modern CPUs are very cost-efficient at this.

This is a matter of implementation; not whether the implementation is in hw or sw. Do you have any examples, where there was a such issue for example in Cavium Octeon (used by Ubiquiti in their USG routers), Qualcomm IPQ-xxx or Marvel Armada SOCs (used by multitude of other vendors)?

> This is a feature, not a bug. It's quite difficult to trust commercial routers.

It is difficult to trust many routers; even if they are open source, their maintenance might be not exactly transparent.

> Citation needed. Modern CPUs are very cost-efficient at this.

Typical routers do not have desktop or server class modern CPU. They run on 700-1400 Mhz, and they are busy with things like firewall rules (why do you thing that Fasttrack on Mikrotiks exists?) or, when a beefier CPU is available, with BGP. You can test it for yourself and see, that with hw accelerated AES and SHA you can saturate your available bandwidth and with Wireguard you can saturate only a fraction (unless you have low enough bandwidth...).