I was initially inclined to agree, especially since openwrt can run docker too, but I think it's fair to question both defaults and supported modes of operation, and how much work it is to go from the default to the desired target state. If out of the box openwrt has less attack surface and you have to go out of your way to add those features, that's probably better than a jack-of-all-trades that comes out of the box with loads of attack surface that you have to pare down and hope that removing the features you don't want is possible/supported.