Both work, I have both in the field. On Bookworm it’s much less fiddly, NetworkManager does the AP and the NAT in one go:
sudo nmcli dev wifi hotspot ifname wlan0 ssid shed-iot password 'long-passphrase-here'
sudo nmcli con mod Hotspot connection.autoconnect yes ipv4.method sharedipv4.method shared hands out DHCP to the ESP32s and NATs them out of whatever has the default route, your 4G dongle. The Pi’s onboard Wi-Fi is fine for 8 clients at short range.
Where I’d think twice is heat and SD cards, plus nobody can reach the Pi when it hangs. If you go Pi: metal case as heatsink, a decent industrial SD or USB SSD, read-only root if you can, and the hardware watchdog enabled.
What a licensed router gives you on Hermetry for the money: you claim it with the code on its local Cloud page, it logs in with its own certificate, you can change its settings and update its firmware from Hermetry, and you can open its web panel from its device page without a fixed IP, which on a 4G link you won’t have. It’s a device in your org itself and counts once against the device limit. Remote access sessions are time-limited and audited.
My rule: one site I can drive to, Pi. Sites that need a ute and a day, licensed router. Details: Licensed gateways and Hermetry Edge.