Does OpenWrt come with a specific coreboot version? I want to install OpenWrt on an ASUS router (supported), but before I do, how can I ensure the most secure setup with coreboot? Does it involve install coreboot first, or can I get straight onto OpenWrt?
Be aware that OpenWrt is only designed to cope with the OEM bootloader (unless we're talking about one of the very few exceptions), there is no attention given to potential alternative bootloaders. OpenWrt only caters to unmodified hard- and software (bootloader/ partitioning), replacing the OEM firmware after the bootloader's handover to the (OpenWrt's) kernel. The intention is to minimize the risk of installing/ running OpenWrt (in the least invasive way) - and to keep (potential) reverting to the OEM firmware reasonably easy. Recovery mechanisms are typically implemented in the (OEM-) bootloader (or are missing altogether), there are usually no second (well, third-) chances.
Replacing the bootloader or changing the OEM partitioning are high risk procedures, on most targets there are no means of recovery if this goes wrong and the device would be dead for good (spi-nor might be recoverable with desoldering the tiny flash chip and re-writing it externally, on NAND this is usually fatal (unless you're very, very lucky and the vendor left functioning JTAG headers or some means to boot from spi-nor, this requires very advanced hardware- and software knowledge and equipment); but either of these would be near fatal.
Patches to accommodate for modified hardware, changed partitioning or alternative bootloaders are usually not accepted (as the permutations would be endless, if every single diy snow-flake system would be supported), so any potential candidate for an alternative bootloader would have to emulate the behaviour of the OEM bootloader perfectly (or well enough for it to not matter). Chances for a modified u-boot derivative (as most ARM or mips devices come with ancient u-boot forks) aren't that bad, but replacing the bootloader with something completely different (coreboot, breed, tianocore+grub, …) are much smaller (without serious development on your side and keeping a stack of custom patches locally).