[aynawn]

Custom supported roms will continue to get security updates whereas oem roms get updates for maximum 3 years since phone release.

From a security perspective, custom roms are still worth it.

[izacus]

Except that a huge chunk of Android CVEs I've seen are related to vendor code which does not get updated in custom ROMs either.

And those are the painful ones, since drivers have kernel access. The security situation on Android is really less than ideal :/

[aaron_m04]

That's concerning if true. Do you have a source?