In setting up an Sony Xperia ZR smartphone manufactured in 2013 and running Android 4.4.1, I am working on understanding the trade-offs involved in loading the custom ROM LineageOS 14.1, which is based on the AOSP version 7.1.1.
The phone is too old to receive regular security updates from the manufacturer. LineageOS users have weekly updates pushed and have access to nightly builds. The LineageOS maintainers seem like they are fast to address security issues. However, in order to install a custom ROM, I need to unlock the bootloader, which can be achieved with a code available from the manufacturer. I read that unlocking can open the phone up to some security vulnerabilities, but the best information I've been able to find are that:
"a tech-savvy thief could fully wipe your device with this option enabled, which means you would no longer be able to track the device's location using Android Device Manager"
and that an unlocked bootloader could allow the loading of software not approved by a mobile carrier, which could be malicious.
In what contexts/situations would leaving the phone as is provide better security? In what contexts/situations would installing LineageOS provide better security?