At this point I'm not so sure what's better: an updated OS or one full of known exploits.
It's a trade-off. I'm installing custom software to improve security, but at the same time, can I trust that this solution won't be a source of malware?
I hope this didn't came out as accusatory, I was just trying to show another aspect of using custom ROMs.
For what its worth, the mirror selection software we're using [1] won't send you to a mirror that has a modified file. If a mirror is doing something malicious (and that doesn't catch it), builds are signed and can be verified [2]. Obviously there's some level of trust involved (build infrastructure isn't auditable, android builds aren't reproducible).
[1] https://github.com/etix/mirrorbits [2] https://wiki.lineageos.org/verifying-builds