thanks alot. would you suggest flashing 15.1 instead of 16.0? why & why not? thanks.
TL;DR: Unless you have specific reasons to choose 15.1 take the latest release possible. Especially as the last LineageOS 15.1 build is from Q3 2019. For example, someone once asked specifically for the last lineage 15.1 build because apparently Android Auto works with that.
I suggest to always flash the most secure ROM that works as a daily driver. That is, your ROM must enforce SELinux, should really be signed with developer keys and include as much security patches as possible. SELinux status should be displayed at the bottom of the about phone screen. To check the signature you need a tool to view X.509 Certificates. It should be enough to check the file
META-INF/com/android/otacert inside the ROM flashing ZIP file. For example if it is issued & verified by "Android", expires at "17.07.2035" and the certificate fingerprint reads
61 ED 37 7E 85 D3 86 A8 DF EE 6B 86 4B D8 5B 0B FA A5 AF 81 then it is definitely a public key and should be avoided.
Other than this just look for the ROM with most stability and best device support. For the devices i have used in the past (the OnePlus X and the Redmi 4X), ResurrectionRemix always had the best device trees while LineageOS usually had some issues with hardware support. For example the official LineageOS builds for the Redmi 4X had problems with the fingerprint & a very long delay when taking photos while i last tried them out.
Unfortunately, LineageOS, Lineage4microg, /e/ OS and OmniROM are the only ROM distributors that i know of who have consistently paid attention to enforcing SELinux and signing with developer keys. Those are fundamental parts of the android security model and while taking care of SELinux can take quite some work, seeing ROM Developers release roms that do not enforce SELinux or sign with proper keys really makes you doubt that they sufficiently understand what they are doing.
So yeah it's a tradeoff between usability, stability & security. You can hardly get out of that unless you compile yourself, potentially putting in a lot of additional work, get a newer phone or get another phone with a good LineageOS device tree or better custom rom support overall like the Pixel devices which are usually the main support group of security focused android distributions like GrapheneOS.
Why is this important?
Simply put SELinux is an advanced permission managent system that can be used together with Linux operating systems. The android security depends on SELinux so much that there are even exlpoits that work as soon as you turn SELinux into permissive mode and nothing else.
The takes of John Wu & the LineageOS team on this topic:
https://twitter.com/topjohnwu/status/1318843385487093760
https://twitter.com/LineageAndroid/status/1365603869493919748/
Regarding signatures:
Since android system apps are granted much more powerful permissions and privileges than regular user apps the android security model requires that an application or an upgrade for that application may only be a system app if it is verified that the application comes from the ROM developer. This is because whoever controls the ROM can get themselves access to all the permissions and privileges they want anyway.
In order to ensure this, every system app must be signed with a special signing key only known to the ROM developer. This ensures that no one can compile & sign a valid application that could be installed as a system app or that could upgrade a system app and take its place.
During the android development process security is not necessary and only a nuisance while debugging so the AOSP source code includes pre-created signing keys for this purpose. While using these, an android ROM developer doesn't need to think about all of this or enter a passphrase to unlock their signing key on every build of the ROM while debugging it.
But since these keys come with the AOSP source code everyone can use them to compile and sign applications with them. They could compile a malicious system application that can be sideloaded on every ROM that is signed with the same keys. Such a malicious application can then take the place of the original system application and gain access to all data saved by the application along with all permissions and system privileges that are granted to that application. Since even the upgrade is classified as a system application by android it can also request additional permissions.
