GrapheneOS is a great project. I had a Pixel 3a XL with Graphene on it and it was a good experience

Graphene does not offer any support at all though once the manufacturer stops releasing new versions. With Lineage I've seen two or three more major Android versions ported than the manufacturer released.

Yes. Its basically AOSP (android Open Source Project) with just enough stuff to make the device useable and you have to add everything else on top of it. A lot of custom ROMs use LineageOS as their base and build from that point.

LineageOS is a project making AOSP (Android Open Source Project) usable. This means bundling it together, combining it with the right drivers and kernel for specific phones.

They also maintain many of the AOSP apps (gallery, phone etc) and modernize them, which is awesome as Google abandoned them.

LineageOS is not security focused and often less secure than stock Android. It has no Google Apps by default, which means a lot of proprietary Apps that rely on the backends will not work, at all.

There is the option to install "NIK Gapps" or other names, which is just a bundle of all Google Apps, installed as System apps, just as horrible as stock Android is.

There also is microG, which is also a system app and is not Opensource, as it downloads official Google Binaries.

Every System app can read critical device identifiers that you cannot change, and can access all files, as it doesnt need permissions.

LineageOS is a usable Android, often more up to date than what came with the device, but those Devices never have full support for Custom Operating Systems, like relockable Bootloader or full security features. So in the end you have more updates but partly less security, more privacy or none.

Also the Updates that LineageOS can even supply are very minor. Android devices use the Linux kernel but a special version tailored to that SOC (System on a chip). They would need to make a custom Kernel just for that phone, often newer, as manifacturers of those cheap phones have nonexistent Update lifespans.

They dont do that as its a lot of (unpaid) work.

Then there is firmware which is only delivered by manifacturers and signed with their private keys. No custom OS can do that and firmware security holes are very important and a lot.

So LineageOS is a really nice project if you donate to them but still save money. Abusing their hard work to buy cheap devices and get their longer OS support for free is not cool.

And in the end it is incomplete, insecure and nothing to build upon when buying a new device.

Btw, a ROM is only a small part of the firmware that you cannot change. No custom OS is a ROM.

When you say "it's no longer secure", can you point to an actual vulnerability on older hardware and what the exploits are?

We keep hearing how unpatched phones are not secure but I'd like to hear more about what the actual risk is.

Millions of people use older phones that haven't been updated for years, yet it seems to me that scams are more about social engineering than exploiting software vulnerabilities on phones.

That is definitely true. Once the vendor stops putting up those patches, it does become quite problematic. So as long as you keep your Android up to date as best as you can and primarily use open source software and ad blockers, you should be alright in most cases.

That is a good point. I always make sure that my devices can run lineage before buying them because I don't want to be stuck with a brick.