It's not optimal because your have to go thru Android anyway and since Android phone end up having a very limited lifetime of updates you will have to run a chroot on top of an unsecure/obsolete Android version over the long run.

There's Lineage OS

Do you still have to download their builds on shady servers?

Build yourself, using your own signing keys and your own patches (if you need any - I do).

There are various Docker images with everything necessary in the Dockerfile and user needs to only specify the device's model name (and any extra options, like build type).

Takes some time but the only thing one needs to trust is the source code (which is nearly impossible to fully audit, though)

It has auto-updates built in, not sure about where they're hosted, though. Still probably more trustworthy (and up to date) than the stock OnePlus Android builds that my phone includes by default (OP3).

What kind of security attack vector are you finding on a offline gaming device with 6-12 month old Android?

Why would it have to be offline?

I've got a Motorola Droid 4 sitting in a drawer, that I no longer use - it's got a slide out hard keyboard - I think I'm going to give this go and see how useful it is.

I carry a Bluetooth keyboard with me anyway so this sounds like the way to go. Or to skip the chroot bit (so things like '/etc/hosts' can be edited). Maybe 2:1 tablets with the detachable keyboard could be an option, however, why learn a new keyboard, a cramped one at that?

GNURoot Debian is broken in Android Oreo, and nobody seems to be in any hurry to fix that. Termux still works well, though.