Are you using the Unbound built into OPNsense, or something else? I ask because it’s easy to configure Unbound in OPNsense for DoT. If your ISP isn’t blocking DoT it will be just as secure.
And yes, it will be much more private. Right now if you’re using neither DoT or DoH your ISP will be able to see all your DNS requests in the clear. With either of the above it will be encrypted and they will not be able to read them.
Why buy a mobo when you could get this for cheaper, in a smaller footprint, and comes with a case and PSU? Do you really need the SATA ports?
Your wishlist sounds almost identical to mine. As frustrating as the limitations of streamers are, they are easy to use. HDMI CEC makes single remote setups possible, easy volume changes, input switching, etc. Apps are vetted so they “just work”.
As for casting, most platforms support running Miracast or AirPlay receivers. Google is the stickler here that won’t let you run a Google Cast receiver (or at least I haven’t found one) and also doesn’t implement Miracast on Pixel devices. It’s such a shame because I vastly prefer casting the URL to the TV and letting it source the content than mirroring my phone all the time.