[mlazowik]

How much can I trust those ROM builders, though? If I use anything other than the official LineageOS builds (e.g. if there are none for my device, or only nightly ones) I can't even be sure that the binaries that people upload match the source code they publish, right?

They might even not publish the source, and if they do, what are the chances that anyone has audited it?

[propogandist]

you only have to install what you trust. Why go beyond LineageOS? Just stick to that, get Xposed and a good firewall. Have control over what your apps send back to HQ.