I used my router for this purpose until recently. It was difficult to keep up with updates, partly because openwrt versions for my router lagged other versions for long periods.

I replaced my router recently and changed my strategy. Now the router is only a router (and firewall of course).

I have a raspi sitting next to it providing the wireguard vpn. This is easy to update and everything actually works better than in past. I attribute a large part of that to wireguard over openvpn, though...