- I intend to run a number of servers and I am actually worried that this dynamic firewall might create problems
I run servers behind TOS and never had any problems.
But some users are reporting problems with ACME lately. I cant’ comment on that, since all my certs are either ACMEd by DNS or if HTTP, then over IPv6. BTW, IPv6 is great for ACME, since it doesn’t affect any NATted IPv4 services on the same LAN.
But you can also always turn dynamic firewalls off. So I would not count that is not a reason to ditch TOS.
- it might be easier to sort out network problems with vanilla openWRT (more documentation, larger user base)
IMHO, there is no difference under the hood between TOS and OpenWrt network configuration.
What you see in reForis, are just predefined OpenWrt configurations, but with hidden complexity for non-tech users.
- I am not super comfortable with dynamic updates
If you are talking about TOS software updates - you can turn that off in reForis.
If you are talking about firewall updates - you turn that off too.