Exactly why I stopped installing LineageOS on my phone.
While part of it was that I was no longer interested in tinkering with ROM and playing cat-and-mouse game with SafetyNet/root detection/whatever, the other part is that I cannot trust these ROMs, some of which come (or came) with their own bloatware. Those that have official builds are of course better, but the overall experience and security situation is still much worse than OEM ROM, despite all the junk there.
P.S. another issue is that I became sick of is devs using xda forum as the only communication channel, including bug reports, updates etc. GitHub has existed for over a decade, and the issue tracker/release system is usable, yet they choose the worst way to do software engineering.
Agreed, the xda forum thing is a huge security smell. "Here, download this big binary from a random forum user and put it on a device you carry with you everywhere which is equipped with internet, camera, microphone, and GPS. You're welcome!"
The GrapheneOS setup seems a lot better (though it has more limited support).
currently on GraphineOS for those very reasons. There is some amazing stuff in XDA forums but ultimately it's just some random guy posting some random ROM.
Only way I was able to get Cyanogenmod on stuff back in the day, was to use shady hacks from XDA, but man it was super slow and seemed to use a ton of bandwidth...
They reduce their need for involvement by being very opinionated about what the project offers.
More projects should strive to establish a culture like GrapheneOS has.