You're safer using a standard Android phone than using an OS as duct-taped together as CalyxOS.
Care to source this claim?
CalyxOS is not a private or secure operating system. They have added several 3rd party apps and services, which includes several 3rd party connections. On top of this, several of these services are given problematic, privileged access.
A notable example of this is Android Auto. CalyxOS grants substantial privileged access to this component by default, while GrapheneOS sandboxes it, and exposes 4 opt-in toggles for privileged access. The user may granularly decide what privileged access they wish to grant.
Can you even lock the bootloader on your device? [2]
[2] calyxos.org/lock
https://old.reddit.com/r/CalyxOS/comments/1t3tdt6/calyxos_pr...
The problem with lagging is that only some of the security patches are backported to older androids, so the project would have to backport remaining ones themselves. Let's be real, no one does that in CalyxOS for all the supported devices.
Out of their 15 supported "modern devices" 10 are pixels.
Their extended support phones (6 devices) has three pixels as well. Might as well get more modern and secure OS instead (A16 with fixes and working call recording for example) :)