... and kind of slow. I've recently looked at Mikrotik hAP be lite (A42G-HbeP ) [1] and noticed only 2315.1 Mbps for 25 bridge filter rules or 1430.3 Mbps for 25 ip filter rules.

I also heard a horror story about RouterOS coming with an insecure configuration by default, lots of open ports and services running which were recently affected by a vulnerability. Speaking of RouterOS do I have to also buy a license along with the hardware? How about updates?

[1]: https://mikrotik.com/product/hap_be_lite

That's not really a fair comparison, since any software packet filter on that class of hardware will be slow.

If you need layer 2 or stateless layer 3 filtering at hardware speeds, Mikrotik makes 10G switches that can do it for under $200. Mikrotik APs also support port and WiFi isolation which is enough security for most home networks (e.g. isolating an IOT VLAN).

Mikrotik's "fastpath" stateful connection tracking feature is also fast in my experience; not fully wire speed but good enough for untrusted devices that you want to be fast, like a Fire stick or game console or similar.