If you use router.allowedMethods() before koa404Handler you get a 404 returned for all OPTIONS requests. Maybe something needs to be added to the docs or something may need to be changed to allow it to work in any order.

I'd suggest just checking if the Allow header is set as that means it'll be an OPTIONS request.

// Mount the app's defined and nested routes
app.use(router.routes());

// 404 handler
app.use(koa404Handler);

// Options method
app.use(router.allowedMethods({
    throw: true,
    notImplemented: () => new Boom.notImplemented(),
    methodNotAllowed: () => new Boom.methodNotAllowed()
}));