Comment by open1414

Android manufacturers pick a LTS kernel when developing their phone. By the time it is on the market, that kernel version only has 3-4 years left of security updates. Custom roms never upgrade the kernel so you are still vulnerable to bugs that were never backported to your kernel