Common security practices are to keep a router for as long as it’s receiving security patches. Once it’s EOL, then replace it.

I have a Gl.iNet router using the latest firmware that just released recently. However, the router is based on OpenWRT and is running v21.02 when the latest OpenWRT official version is 24.10.3. On OpenWRT’s website v21.02 is considered EOL.

So should this router be considered EOL? Should the whole company not be worth buying from since everything sold is immediately EOL? I don’t understand enough about cyber security to know how significant the jump is from v21.02 to v24.10.3.

PS. I know these routers can be flashed with straight OpenWRT but this is for the sake of my thought experiment.