Flash upgrades are relatively easy, soic8/ soic16 is something you can deal with (parallel flash on older devices or NAND would not be).
RAM upgrades are a topic I would avoid, even if they'd be -desperately- necessary for anything with 32 MB RAM or less. Size- and number of pins is just excessive, finding the right -compatible- chips is non-trivial (and might need several attempts). Desoldering these is hard, so unless you get a new separate chip (and don't have to harvest it from a larger module) and basically cut away (destroy in the the process) the old chip, it's typically not something you can do at home (without a lot of practice, hot-air desoldering station and -again- even more practice).
Software-side, the changes are reasonably 'easy', but as flash size/ partitioning and RAM size are hard coded in the DTS, you will have to keep fixing the software for 'all eternity' into the future - as you won't be able to flash an unmodified firmware again. Care is needed to find a flash chip compatible with the existing bootloader, otherwise you'd have to fix that first (that might be hard), this limits the maximum size to 16 MB on most devices (32 MB flash chips need special support from the bootloader, as its accessing is different). Warning, keep the RAM size in mind for sizing the flash chip, this needs to fit into RAM during upgrades - so a 16 MB flash chip would be hard to fit into the RAM.
Yes, it's possible, if you choose your components wisely and manage the soldering. But keep in mind that it will need constant attention into the future (flash an unmodified firmware and the device bricks), that also implies rebasing your patches regularly (kernel upgrades may break your patches without you noticing, as your patch still applies to the old kernel, while the new -unpatched- kernel is installed).
…and at the end of the day, the device remains old, slow and with slow single-band 802.11n 2.4-GHz-only wireless. I would not touch draft-n/ ar9132 based hardware anymore (only 400 MHz, very fragile wireless, not worth the effort), yours is fortunately newer than that (qca9533) - but the single 100 MBit/s ethernet port is still 'not great'. While you can do it, I would not consider this to be a sensible approach for this kind of hardware (and even less for even older ones). This situation might be different for a tl-wdr3600/ tl-wdr4300 (8-128 --> 16/128, where the flash upgrade would be reasonably easy, RAM sufficient, and the general hardware more sensible for continued use).
Don't even look back at 18.06 for this, current OpenWrt still has all the necessary support - even if it would never fit into 4 MB flash anymore (and is therefore untested!), it has not been actively removed yet (although a clean-up may happen in the future, as we're past the point where simply dropping some packages would make a buildable 4 MB image - and 32 MB RAM does mean sacrificing even more (e.g. WLAN altogether)).
EDIT: given the RAM size (32 MB), I would not go beyond 8 MB flash for this device; if you do -successfully- upgrade the RAM, there wouldn't be any reason not to go 16 MB flash.
BUT, still keep an eye on the economics of all this. Even if you have the soldering equipment (>>100 EUR) and the practice, the spi-nor writer and clamps, with shipping and everything you already get close to 5 EUR (and more) for the components alone - but for that kind of money you can already find more suitable devices on the various used markets (e,g, the aforementioned tl-wdr3600/ tl-wdr4300) in working condition.
)
something I should not open...