That's NOT solved by rooting - I wish people would stop saying this.

There's two parts to Android patching - the kernel/Android OS itself - yes, this gets patched with a rooted/custom ROM.

Part two is the hardware drivers themselves, the modem driver etc etc. None of that is patched with a custom ROM. You still have to use the same binary blob/drivers that came with the latest official phone firmware.

When security updates stop for you phone, all the updates for the underlying hardware drivers stop too. So yea, you can slap some bandaids on it, but you're not really up to date even though you might be on a later/more recent version of Android.

Your definition of “solved” is pretty identical to OpenBSD user recommending to “just patch your BIOS”. Demographically this is not a solution, as 99.9999% of the potential audience will never be able to even understand the requirements of that skillset.

> That was an issue with one phone, once, and it was a problem with the battery, not Android

If my house burns down, I personally won't care if it's android in general, the model, or the battery in the android phone which destroyed everything I own.

> That's actually solved by rooting since you can update from any source instead of just signed packages

Installing software downloaded from xda-developers is, what I like to call, malware as a service (tm).

That's like saying that all Apple products suck because they bend, antenna doesn't work, keys stop working and screens start to stain.

Like the person said, it was literally one Samsung model that had issues and it could've just as well have been an iOS device. Looking at how many recalls and repair programs they have for design flaws, I don't think anyone should paint Apple as the better side here.

Can you link me to a custom ROM on XDA that was shown to have Malware?

That's a poor argument. That's like saying you didn't read this page's article, because the malware being discussed wasn't already known to you. Absence of evidence is not evidence of absence. Formally, this is called an argument from ignorance.

This seems like a pretty weak argument, are you sure you want to trust a bunch of hobbiest devs with the security of your (probably) most valuable computer?

Just because something doesn’t have any know issues, doesn’t mean it’s not wise to avoid it because it flat out smells.

I trust hobbiests more than I trust Google or Apple to handle my security.

That really depends on your threat model, are Apple and google going to use marketing data against you? Probably.

Are they going to plant malware which steals your banking details? Probably less likely than a random binary package you found on some forum.