Correct me if I'm wrong, but your quote then implies that it's still fine even with microg installed, right? So maybe OP is talking about something else? Or are you saying that they're misguided?
I'm not enough of an expert to say for certain, and I'm not exactly sure what parent comment means when they accuse LineageOS of "destroying" the "Android security model", but from what I've read, concerns about signature spoofing are overblown - provided the user is very selective about what apps they grant spoofing powers to.