It's a bit of a weird expectation to want OpenWrt to work around a Tomato bug. I hope the Tomato guys can help you, since in the end all they got access to is binary blobs as well. The Tomato community is where you should look for a solution, now that it's clear the issue is on their end.
As you can see here it responds to the OpenWrt wireless scan but won't connect yet other devices can so I don't think you can say for certain that it's a Tomato bug
I don't know a **** of tomato but if they are similar to OWRT and they use the softmac/hostapd stack, you probably can set the "hidden option" directly in to the hostapd config file o via hostapd_cli (instead of the wireless config file or UCI equivalent they could have)
You can explore two different options, changing the default value specified as "0" to "1" or "2".
# Send empty SSID in beacons and ignore probe request frames that do not
# specify full SSID, i.e., require stations to know SSID.
# default: disabled (0)
# 1 = send empty (length=0) SSID in beacon and ignore probe request for
# broadcast SSID
# 2 = clear SSID (ASCII 0), but keep the original length (this may be required
# with some clients that do not support empty SSID) and ignore probe
# requests for broadcast SSID
ignore_broadcast_ssid=0
My FreshTomato Netgear R8000 AP was connected to OpenWRT TP-Link Archer C50 V3 on SSID "Bridge" channel 52 (5.260Ghz) and the connection would fail when the SSID was hidden.
I found that when connected to channel 36 (5.180Ghz) or 40 (5.200Ghz) the hidden "Bridge" SSID connects without issue.
I did notice that some client devices didn't like channel 52+ so I guess that also includes the TP-Link Archer C50 V3.
When you mentioned DFS I searched the forum and found this which matches the channels I tested that hidden SSID does work, and the ones marked radar detection are the ones that don't work: