I've worked with people whom have venemously sworn by either or and I've seen both play out successfully or badly tbh. But I suppose the same could be said for any "good practice" if you abuse it bad enough
But I accept serialization business logic isn't pretty and hence I try to avoid "sensitive" information on endpoints that I expose. Ids to me are fine as consumers can delete stuff as well or retrieve stuff by id
if I did it using DTOs I'd have to tell OData the mapping between the two and do some complicated business logic mapping code such that the IQueryable for the DTO could be translated to an IQueryable for the domain model