What are the privacy and security considerations of running an open source operating system with Android 8 (Oreo)? I believe this (as Project Treble) would gene

What are the privacy and security considerations of running an open source operating system with Android 8 (Oreo)? I believe this (as Project Treble) would generally leave the lowest layer of the vendor-supplied Android still in place, potentially giving them some responsibility and control.