The idea of does everything for me, including updates and minimally secure are disjoint ideas - you can't have security unless you have complete control over your own device - and OpenWRT with luci already provides that. Relying on a third-party to do your updates, even if it's a trusted body like the EFF is always open to attack.
OpenWrt doesn't provide the self-update by default, and I hope it never decides to add such thing, unless we get reproducible builds, and build some kind of network consensus to verify the integrity of packages, and that they were derived from specific source code (as Nix/Guix and Debian's ReproducibleBuilds are attempting). In other words, we need to remove the centralization of updating, because it's such an easy target for the likes of you know who.
Also, you know what else is such an easy target for the likes of you know who? Unpatched systems.