It's not ideal, but it's not a deal-breaker for every use case. The kind of firmware you get on a barebones industrial-oriented miniPC style router from China doesn't have much potential for a remotely-exploitable vulnerability. Most of the NICs aren't even going to be touched by the boot firmware. The user-supplied OS can take care of applying CPU microcode updates. If the PC doesn't ship with a rootkit already present in the firmware, it's pretty hard for the firmware to be a security problem unless it's secondary to a security vulnerability in the OpenWRT or pfSense software.

Running an up-to-date OpenWRT or pfSense on a normal PC hardware platform with outdated UEFI firmware is still a big step up in security compared to running factory firmware+OS on a cheap consumer wireless router.