OpenWrt is always updating. The cleanest method to ensure full compatibility of kernel mods is to build the kernel and kmod at the same time. NSS applies kernel mods so the kernel is changed and not compatible with official kmods installed via opkg. Opkg doesn’t have a “check for compatibility” feature in a live system that can sort out and update the kmods. I initially was nervous to build. Once I figured out the process, I actually prefer building because I can get exactly what features I want. The build process is not that scary anymore. 
Ex: I update my build this way, it rebases the build with the latest OpenWrt commits, updates all the package feeds, and installs all the latest packages. I then build the firmware based off that. If you think about any commercial firmware they do a single firmware file to best safety update multiple main features at once:
git fetch upstream && git rebase upstream/openwrt-21.02
./scripts/feeds update -a && ./scripts/feeds install -a
When you build you can make a repository of compatible packages that you can choose to install later on like this:
My start to finish instructions are here: