Personally, I’ve considered this, and there a few shoddy scripts running on it (the networking setup is terrible; and the script even has variable names in Chinese), but that aside I’m not sure whether that’s of any more of a concern than with any other proprietary manufacturer‘s OS (eg Cisco et al).

And as other people have said, you can literally throw any other distribution on it and it’s just “dumb” hardware… so I would consider the risk fairly low