You are correct, but you can still get around some of the warts involved if you want. You can always lock the bootloader again after installing your ROM. Unloc

You are correct, but you can still get around some of the warts involved if you want. You can always lock the bootloader again after installing your ROM. Unlocking it will wipe the device again which is inconvenient for ROM updates etc, but if you're a trooper, you can do it. This inconvenience was pretty easily fixed with the open source bootunlocker[0] apk which allowed to you unlock and relock the bootloader once in rooted userspace, but sadly it doesn't work on anything newer than the original Nexus 5 due to security features in newer Android hardware. Manual unlocking, re-installation and boot re-locking is still possible. The decryption password can be beefed up with adb from the terminal as well. There isn't a pretty gui for it, but that way you can get a strong safe encryption password and a short screen unlock pin. Unfortunately the two are tied iirc normally. Some would argue that having an organically strong password is safer than allowing the hardware to help beef up weak pins. I'm sure there are other problems, sadly Google seems to look at privacy and security on Android as issues for later. And running anything besides a nexus device is entirely less safe due to the toxic OEM/Google update environment. [0] https://code.google.com/p/boot-unlocker-gnex/ https://code.google.com/p/boot-unlocker-gnex/