@GrapheneOS /e/ and iodé are based on LineageOS. It is said that LineageOS is actively merging security patches from the AOSP, but vendor-specific security patches relies on the vendors and varies, and LineageOS shows two separate security patch levels for the system and the vendor firmware respectively. I wonder the security situation of LineageOS, and whether it is a phony security project as well.
@rebel1725 LineageOS lags months behind on major AOSP updates. It merges the monthly AOSP backports to older releases within a couple weeks but those are only a subset of the overall patches. Portraying the rest of the privacy and security patches as all being vendor patches is wrong.
AOSP only provides incomplete backports to older releases in the first place. Only the latest major release is well supported which is currently Android 17 and very soon Android 17 QPR2. Older releases are not.