> They say this is to ensure the security of your device that logs into your bank or whatever, but I guarantee that my LineageOS updated this week is more secur

> They say this is to ensure the security of your device that logs into your bank or whatever, but I guarantee that my LineageOS updated this week is more secure than my stock Google ROM that got its last update 3 years ago Those are two entirely different threat models. The second clause of your sentence is about vulnerability to exploits, something that Lineage or other ROMs are at least better positioned to do than a vendor that has EOLed the device (though the amount of binary junk required by those distros puts a pretty firm cap on that promise -- they can only fix what they can patch!). The first clause talks about the need for back end service providers to be sure that no entity is interposted between them and their users/customers. It's a desire that no extra app can sit there and sniff interaction or prompt for passwords/tokens/secrets/etc... Third party open ROMs not only fail to address this need, they actively hurt. You can trivially make a "We're Totally Your Bank We Swear" app and deploy it to a LineageOS phone that steals the money from any account that authenticates with it. Is that a "good" security model or a "bad" one? There are arguments to be had. But prompt application of bug patches isn't one of them.