With their router, I can isolate it and do packet sniffing, which is how I learned they were pinging 8.8.8.8 as part of their port fail-over, and calling home for update info. With AstroWarp everything is encrypted, so packet sniffing tells you nothing. If the encryption is solid, anything can be hidden inside it.
I agree that most people do not audit open source code, but many researchers and graduate students do, and that is exactly why open source projects get real scrutiny.
At 300+ people, they are still small, and just a rounding error when compared to the number of employees at places like Cisco, ASUS, or TP-Link. They do not have sufficient resources to keep their firmware promises to their current customer base, without taking on new projects like AstroWarp, as shown in this recent reply by @will.qiu Will GL-A1300 get firmware 4.7? - #5 by will.qiu