ddwrt can't fix all firmware flaws. These routers have some black box software that nobody knows whats in, those are the riskiest ones.

ddwrt doesn't have firmware updates that manufacturers themselves do not provide, so old obsolete hardware can be vulnerable in perpetuity without ever receiving a fix, ever. Maybe they can patch in a workaround, maybe they never know about it.

You'd have to look at your specific model router to see what vulnerabilities are known as CVEs, and then see if those CVEs are patched by ddwrt. Nobody does this kind of research outside of enterprise security/it teams in my experience. Plus you never know what vulnerabilities exist that haven't been reported and thus do not have a CVE yet... the older the hardware the more likely there is a big gaping RCE flaw that lets who knows who add your router to their bot network with a rootkit.