Being able to just get one device and use it for 5+ years is such a relief, and gives me a lot less to worry about day to day. Custom roms are best left to tinkerers who are okay with their device randomly breaking with no rhyme or reason, and spending hours either trying to fix it or reflash/restore to stock and set everything back up again.

“A year and a half of OS updates” rapidly becomes 6 months of OS updates if you don’t buy on launch day, wait for prices to drop a little bit and inventory to normalize, etc.

I have found both to be completely stable.

My first Cyanogen phone was an HTC Incredible, and I don't remember any stability problems.

For general messaging and browsing this hardware likely work quite well.

Btw I had the Motorola Defy and flashed it every month with a new ROM back in the days :D

The same applies to most open source efforts, but I think it's understandable for institutions with consequences to what their apps do (like handling money and bank accounts) to opt out of potentially being undermined by the OS when they have the means. There's also elements of phones being general purpose computers now vs locked down appliances, GPL3 vs tivoization, and so on.

Also knowing what security risks are in play with N year old OS lets them decide if they want to allow the user to proceed or work around. Some applications are more aggressive in what version OS they need and that's a driver for upgrading phones, pushing the OEM to keep a phone in support for longer, or third party ROMs if this catch22 wasn't part of it.

I've seen plenty of apps need a minimum major version of Android, but never any that have needed a minimum security patch level.

There's simply no universe where an employee at a typical F500 company is going to be able to convince the IT team that they should permit custom code on phones even if the logic of the argument is sound. Even if they found the person, persuaded them, got them to persuade their management, in house legal teams, compliance teams etc., I seriously doubt whether the MDM solutions (eg InTune) would even have a checkbox to override the policy on one phone. To say nothing of the ongoing cost of tracking that one employee's specific setting.

This also plays a bit into the argument of why integrating your personal device into the corpo ecosystem of your employer is not a decision to be taken lightly.

That's my point: I know that's how it is today, but the reasons for it being that way are illogical.

Works fine for me, two banking apps and two digital ID apps running on a Google-free device. About those CVEs, you do realise LineageOS offers OTA updates? Not everyone will install them but the same goes for vendor updates, probably even more so since those sometimes sneak in unwanted 'features'.

If 'your company' 'might need to exclude [my devices]' I will just steer away from 'your company' just like I steered away from the many 'Windows only' companies. I survive, nay I thrive without having to use Windows and the same goes for Google et al.

Nae kings, nae lairds, nae quinns, we are free men!

I wonder why it was made.

Sure, some people don't care about things like Google Pay, but many many many of us do. I really miss the days of CyanogenMod, before SafetyNet was a thing, when I never worried about losing access to functionality I care about when installing a third-party Android OS.

Even though the Pixel 8 is larger than I'd like, and the Pixel line has its share of problems, I'm thrilled that my new phone will get 7 years of security updates, and probably -- hopefully, if Google doesn't renege -- OS updates for those 7 years as well. That's incredibly important to me.