I used CyanogenMod (LinesgeOS) in the past on older phones, but it is not for the average use to download, install and configure all the bits and pieces needed for this. The support for the phones is also very limited, half of the phones in my house are not supported (and they are manufactured by Asus, not by a very small manufacturer).

Using LineageOS and other custom ROMs isn't straightforward even for technical people. And Google is actively making the experience worse in the name of "security". Installing a custom ROM introduces an artificial delay while your phone displays a FUD screen telling you that your phone can't be trusted.

They are not lying, of course. A well-known advertising company known for its engine[1] has installed a rootkit on it. Of course, this warning is about rootkits Google doesn't trust (either).

If security was the objective, Google could easily improve it without compromising freedom. Let people choose who they trust.[2] Encrypt the OS so attackers can't modify it. Or not telling attackers that there's an unlocked backdoor they can use.

[1] Missing: <s>search<s/>

[2] Technically, Android supports enrolling your own key. But that's optional for device makers and I haven't found any useful documentation. You also still get a warning on boot, this one is yellow.

[3] Replacing it is easy to detect unless you somehow manage to replicate the phone state as it was. Part of that state could even be a kind of reverse password that the phone uses to authenticate itself to it's owner.