N.E.P.T.R

While I do find GOS drama a bit annoying, they aren’t wrong about the lacking security of many AOSP forks. iode and /e/OS have a history late patches for security vulnerabilities in both the OS (https://web.archive.org/web/20241231003546/https://divestos.org/pages/patch_history) and for the forked apps they bundle with it. Each Android monthly and Chromium patches usually contains dozens High Risk CVEs, so taking a month or 2 is unacceptable. Neither are good for privacy or security.

See a comparison between some Android ROMs here, especially noting the update speed section: https://eylenburg.github.io/android_comparison.htm

Firefox is even more insecure as a Flatpak than Chromium. At least with Chromium using zypak it can use some Flatpak sandboxing (which is still inferior to base)

While I agree it would be nice, Flatpak weakens the Chromium sandbox by stopping proper per site isolation. Chromium in Flatpak relies on the zypak server in place of proper strict isolation.

It is source available, not open source.