OEM ROM:
- just works / ootbe
- proprietary features
- project mainline: security updates and some system components updated independently of OEM after EOL
- safety net / play integrity
- look & feel is on a higher level than an average custom ROM
- years after EOL, majority of apps will still support the ROM, kitkat is loosing support from play services this year, majority of apps target lolipop.
Custom ROM:
- fun with tinkering
- risks, worries, time spent
- more updates
- hit & miss -> either better or worse battery life, these are often targeting middle-school boys fanatic about anime, overclocking destroys heat management and battery life, safety net can stop working any day
- sketchy hacks to get some services for free etc.
- nice hacks to get 80% battery charging limit, underclock, automate tasks
- huge fragmentation and duplication of effort that leads nowhere among tons of ROMS, competition among them does not do any good currently as they have no incentive to compete
- unlocked bootloader -> less security when it's confiscated; but some people are able to lock the bootloader on a custom ROM.
- on one hand increased privacy, but not many people audit custom ROMS, so they pose higher security and privacy risks.
I just scratched the surface, but I think custom ROMS have failed people like me who value having no worries about safety net limiting their contactless payments, cards for public transportation within apps, those who value battery life and love underclocks, professional look instead of kitsch, peace of mind, features out of the box like dolby atmos, additional features from the OEM like gesture screenshots, scrolling screenshots and a lot other features.
Let me know if I'm wrong in the comments.
If the bootloader is locked it won't let the theif bypass the screen lock delay. This will make it much harder if not impossible to get you data. They will have to factory reset it to make it of any value
On the other hand if it isn't locked they can just boot into a brute forcing program and brute force you pin. They also could modify the os since it isn't encrypted. The modification would collect your pin for later or could be full malware that sends data to them over the internet
Yeah, and thieves are definitely going to use your data rather than sell it anyway
Its hard to say what an advisary can do or what they are. I want general protection a wide range of threats
I understand there are use cases that require high security, like a whistleblower. But at the same, security is about minimizing risks that are likely to happen, you pay attention and obey traffic laws, you don't stay inside your house forever fearing a car accident.
True but I don't want to have to concern myself with what happens if I lose my device.
I want a basic level of security