I think evil maid attacks are a realistic problem for anyone regularly travelling through airports. I think there are quite a few people who would like to know when someone tampered with their phone. Certain shady governments are known for demanding you hand over your phone if you look suspicious/foreign enough.
I have no experience with GrapheneOS, but I've heard good stories so far. It's very good to hear that the Pixel devices allow re-locking of the bootloader.
Personally, I consider exploits in the Android framework itself and drive-by-exploits (like BlueFrag) to be the most important security vulnerabilities so I'm fine with LineageOS.
Not everyone might agree, though, and custom ROMs come with some security challenges or problems that stock software does not. I don't think such flaws should be left out of discussions like these.
Re:LineageOS 19
by lberrymage on Tuesday April 26, 2022 @02:08PM
(#31170951)
Locking the bootloader (to enable verified boot) isn't only a protection against physical attacks. It also ensures that any deep OS exploit that occurs is not persistent since the base OS is cryptographically verified on boot. This is really important to the security model, because otherwise you have no reliable way to protect against persistent exploits or verify that you're running a genuine release of the OS you think you are.
I personally think the booloader lock is of dubious value. It protects against physical attacks against the device (evil maid attacks).
That's very low in the list of threats I worry about.
(Though I am using GrapheneOS, and am happy with it.)
I'd be more worried about the lag between Android security patches (and vendor blobs, which GrapheneOS gets direct with android updates, from what I can tell) and custom ROM updates.
You're much more likely to get hit by some Samsung zero day that impacts 100M active devices than something targeting a custom ROM.
(All of this is assuming you're a boring target, which most people are.)
Anyway, the main deciding factor for me between the two operating systems was device support.