I just say that a simple OpenWrt router is not much of an initial attack vector. Unless you open SSH to the public with weak passwords or do some generally bad practices like running outdated Docker/LXC containers on it, there is no need to worry about Spectre/Meltdown class of attacks. There are much lower hanging fruits, like all those insecure routers/cameras and IoT junk that typical botnets and malware tend to attack. I haven't seen a remote vector against OpenWrt, because it doesn't open anything to the public by default and whatever it runs is something you installed yourself. Regarding VyOS I never looked at it deep enough, they mostly focus on commercial customers even if the base product is open source. This might make them more vulnerable, simply because their customer base is more valuable so adversaries will be interested to spend more resources targeting it. But that's pure speculation.
P.S. PF/OpnSense do have kernel wireguard since long time ago.
Quite an extensive list of software for it as well: https://github.com/opnsense/plugins