> The software is not anywhere near audited

Many of the projects leverage a well known OS as their base (e.g. pmOS uses Alpine Linux, Mobian uses Debian), and actively ensure that anything that can be upstreamed is upstreamed. So it's not like you're downloading some random ROM off of XDA.

That doesn’t make the system audited. The obvious reason we don’t hear more about the weaknesses is that no high value targets are using these systems, so it’s not worth exploiting them.

Um, these distros are normally used to run like half the Internet, they are very valuable targets today and I don't think putting them on a phone changes the threat environment so much.

The threat environment is utterly different between an individual person’s phone and an anonymous server behind a firewall on the internet.

It’s not even close.