Thanks for the positive feedback
Depends on "how" the app is bound to the PS. Right now, it only seems to be an installer flag, so you have worked around it. Some apps however use PS license verification - as explained in the Aurora FAQ, in such a case, you're lost. Same applies, if e.g. the "Safety net" api is used; this isn't related to the play sore, but the genuine Google Play services (I always call then "Spy services").
Phew... That's a complex question. The "short & easy" answer would be "no, it does not matter!", but that answer deserves some further elaboration, as it in fact is not that easy:
A ROM has got in fact four "components":
- The device-independent android platform
- The Linux-Kernel
- The device hardware drivers (aka "vendor blobs"), which are closed source vendor delivered
- The device configuration, which glues the above three together
Whilst the device-independent android-platform is usually very well maintained (or back-ported), the maintenance of the kernel and the updates of the vendor blobs is a different question and depends on the device maintainer / ROM builder.
The older the android version, the harder the backport and the bigger the "unknowns". Android 9 isn't officially supported any longer by Google, but so far, it has been pretty straight-forward to backport the ASB patches, so Android 9 I would still consider 'safe'. But I am also providing Android 7 based ROMs, where it starts to become very difficult and also a "grey area"...
This ROM here for the P9 of this thread is a "treble build", so only the device-independent android platform is updated, whilst kernel and device blobs stay "as is". (Unless Huawei surprisingly delivers another EMUI 8 update, which I severely doubt...)
So I would split the question into two different situations:
A.)
Q: For my device "ABC", there is only an Android 'n' build available, whilst the most recent Android release is meanwhile 'n + x'. Do I need to worry?
A: The available ROM is the "best", you can get for your device and for sure better than using the outdated stock ROM. So in the absence of a true alternative (other than getting a different, newer device) there is nothing to worry. I think that would describe the situation of the P9 quite well, I think. Having said so, if you fear being "professionally targeted", seek professional advice and aim at least for an "original" GrapheneOS device...
B.)
Q: For my device, there are Android 'n' as well as 'n +1' or even 'n + 2' builds available. What should I do?
A: First of all, the functionality counts. Is the build with the latest Android release really stable, has acceptable performance (the newer the Android release, the higher the hardware demands) and is really daily-driver capable and also offers the features, which are important to me? If the answer is no, rather stick with the current stable, fast and daily-driver proven build.
(Just some thoughts: ROMs, where e.g. SELinux has been deactivated in the kernel are experimental and unsafe, applying ASB patches to such a ROM is close to useless - such stuff may be nice as a temporary test, if you are interested to see the look and feel of a new version, but don't use that as "daily driver". Further, some ROM developers apply heavy downporting modifications to a modern Android version just to get it "somehow" running on a very old device - also not what I would consider a "daily driver" use. Another example: I used to offer LineageOS 17.1 builds for the Osprey device, and finally decided to stop it and offer again LineageOS 16.0 builds with recent ASB backports for it, as 17.1 simply was too laggy and slow)
If however there is really no difference, the more modern Android version is to be preferred; especially, if the device manufacturer still delivers updates, which means that even the vendor blobs can be updated.
Hope that could give you a better view on that topic.
