Assessing security tradeoffs with LineageOS on older Android phones

Question

In setting up an Sony Xperia ZR smartphone manufactured in 2013 and running Android 4.4.1, I am working on understanding the trade-offs involved in loading the custom ROM LineageOS 14.1, which is based on the AOSP version 7.1.1.

The phone is too old to receive regular security updates from the manufacturer. LineageOS users have weekly updates pushed and have access to nightly builds. The LineageOS maintainers seem like they are fast to address security issues. However, in order to install a custom ROM, I need to unlock the bootloader, which can be achieved with a code available from the manufacturer. I read that unlocking can open the phone up to some security vulnerabilities, but the best information I've been able to find are that:

"a tech-savvy thief could fully wipe your device with this option enabled, which means you would no longer be able to track the device's location using Android Device Manager"

and that an unlocked bootloader could allow the loading of software not approved by a mobile carrier, which could be malicious.

In what contexts/situations would leaving the phone as is provide better security? In what contexts/situations would installing LineageOS provide better security?

Answer 1

You have essentially the following options:

1. Throwing the phone away or keeping it off the networks (which makes it useless for many users) since the OS has known security issues but there are no more security updates for it.
2. Accepting the risk of running a phone with known security issues, which depending on the issues might be exploited just by surfing the internet or receiving a MMS or simply by having WiFi active. Note that such exploits can very deeply infiltrate the system since many of the exploits allow to run code with root or even kernel permissions.
3. Unlocking the bootloader and installing an up-to-date alternative OS and accepting the risk of having an unlocked bootloader. This risk of having the bootloader unlocked can be an issue if somebody else gets physical access to the device for some time or if a serious OS exploit with root or kernel level access is possible. The last risk is hopefully mitigated mostly by having an up-to-date OS.

None of these options is without some risk or at least serious usability or cost issues.
But in my opinion the last option of unlocking the bootloader and installing an up-to-date OS (and keeping it updated) is far less risky then the second option of running an OS with known and serious security issues.