How paranoid should I be about routers from companies like Cudy that I’m not familiar with? My intuition is “very paranoid, even if I replace the firmware with OpenWRT”.
Yes, you are being too paranoid. Once booted into Openwrt the router will only be running Openwrt code. I guess there's the tiny possibility of a backdoored bootloader but that would have to be a pretty sophisticated backdoor!