Isn't Merlin just the Asus firmware with some additional features? From a security perspective it does not seem like an upgrade since it still includes many proprietary Asus blobs.
How much does the "proprietary blobs" matter, for something like a router? It sort of makes sense a cellphone where there's basically a parallel operating system running in the baseband, but that doesn't really apply for a router. The biggest threat is probably out of date services, but AFAIK most of those (eg. dnsmasq) are open source and are kept up to date.
Depending on the router, a whole bunch: I had an ASUS router that could only maintain about 150-200 Mbps of NAT traffic using the CPU whereas with the magic cut-through blobs it could do a full 1 Gbps.