Maybe you can try getting DivestOS running. They only have 14.1 (Android 7.1.2) but unlike old LineageOS builds they patch security vulnerabilities and include some hardening.