I think that's just because stock ROMS have become good enough that we don't need custom ROMS; except for purposes like de-Googling your phone or removing stuff installed by your OEM.
From a security perspective, custom roms are still worth it.
And those are the painful ones, since drivers have kernel access. The security situation on Android is really less than ideal :/