Long-term custom ROM user here.

Regarding security: as always, it depends on your threat model. If you fear a government actor getting access to your phone, a locked bootloader won't slow them down.

Regarding privacy: I've had both VPN logs and external Wireshark running against traffic going in&out of my custom ROM phones & sometimes I still do it for fun. If you know what you're getting into (e.g. LoS still using some Google services) then a Custom ROM usually holds far fewer surprises than some questionable OEM ROM (and which is terrifyingly scarce regarding changelogs while still having OTA update power).

tl;dr: stick with well-known ROMs & you get ... not the best of both worlds ... but a "good enough" of both worlds.

I just flash LineageOS even when the device is currently supported by the OEM. I buy the hardware from them, not the software.

Edit: Like, the vast majority of actual custom ROMs users are either using Pixel Experience or LineageOS, there are a bunch of other ROMs, but those are mostly "purpose built" for enthusiasts of what they offer. Like, GrapheneOS is for security reasons, and things like that.

There is a bit of headache installing custom ROMs, but once you install it, it is usually pretty stable. Also, I don't get the locked vs unlocked bootloader thing in regards to security. The device is stolen and outside your hands, it is doubtful that a thief would go through the steps of flashing a ROM, but wouldn't be smart enough on how to make the device unusable if it had a bootloader locked. Either way you are screwed.

/e/OS is a fork of lineage os and replaces google play services with microg and open source apps annnd it doesn't break safetynet

I flashed a custom ROM even before the first year of life of my device and never looked back 😅

All my phones were bootloader unlocked before within the 15 days of purchase date. Never bothered about warranty. It is always custom ROMs.

• If you're going custom ROMs, always go with an official custom ROM. Go with a well - trusted one that is consistent with updates, not an official ROM that may be dropped at a moment's notice.
• Always choose devices that have long - term support and are consistent with security patches like the Google Pixels (5 years). Do not choose brands like Xiaomi as their lackluster updates mean that you will receive late security updates, and proprietary drivers for the components in your device will go out of date in 2 years. Your phone will be insecure and cannot be made secure when those 2 years end.

I just use lineage os and its nice. I don't use google stuff so I run mostly stock

I use an mi max 2 as my daily phone

It's got crdroid 9.7