I haven’t done a code review so I can’t answer that question with facts. I do think however, that anything that bootstraps a FLOSS framework like openwrt could easily be a risk to privacy.
You use privacy and security interchangeably here. They are not the same.
Ran into a similar conundrum. We use mealie for recipe management and occasionally meal planning, but the shopping list is clunky. We resorted to just making a list on a card in Planks. Not purpose-built, but it has worked rather well for us.