Homebrew ROMs often don't have Google's holywater blessing of being certified, so some things like banking apps might not run on them.

So, say your phone has old Android version x. You're fine until a security hole shows up, or your banking app says "Our app needs Android version x+1. Please update your phone.". Oops, not offered by phone. Install a custom ROM. Banking app says "This device is not certified and for your own security, we refuse to run on this phone."...

Doesn't "Magisk" alleviate a lot of that? Except for I believe Netflix and its Widevine bullshit

Commenting from CalyxOS, which usually receives Android security updates within a week of release https://calyxos.org/docs/guide/device-support/

To test this out I installed apps from 3 of the largest banks on a Nexus 5 running Lineage OS 20 (Android 13 - yes a 9 year old phone with 2GB of RAM running Android 13 very well) with a minimum install of Google Play Services. 1 app said I was running a modified version of Android, but let me proceed to log in. The other 2 let me log in immediately with no warning message.

What APIs do the banking apps use to verify the holy water blessing?

Never had this problem, really. The smart people on XDA have this figured out.

I've been running custom Android ROMs for years on multiple phones. It has brought me modern features and better performance than the vendor's ROM.

It's complicated with Android due to closed-source drivers, someone needs to create an installer for the specific phone model. The installation process is also more complicated than installing a new OS on a PC, but it's perfectly doable if you can follow written instructions. I recommend checking your phone's forum on XDA, you'll see what the community made.