LineageOS's security story is appalling though.

https://cve.lineageos.org/kernels is their tracker for CVEs in non-deprecated kernels they ship in officially supported devices: no kernel they ship has 100% of CVEs patched, and both mean and median are about 49% of CVEs patched. And this is before we start even considering the firmware blobs that are shipped that haven't had security updates in years.

Plus, you have to execute non-reproducible binaries in order to install LinageOS on your phone.

Bizarrely, clicking on "Downloads" for LineageOS takes you to what looks like a bug tracker and is actually a changelog. Yes, you click for your model in the left aside, but it sure takes some figuring out.

Yeah, the homepage could definitely use some improvements.

Does LineageOS integrate google apps/services by default?

No, adding "gapps" is an optional (unsupported) step after imaging the device.