All of it, custom roms dont help at all. For example custom roms dont solve their broken implementation of verified boot or how they used public keys for verified boot. In addition custom roms rarely go out of their way to add security patches that the OEM hasnt added themselves. For example, GraphineOS relies on Google to publish security patches in a timely manner for them to keep GraphineOS secure. GraphineOS can trust Google because they have a proven track record of publishing open source security peatches in a timely manner while Fairphone has proven to be the exact opposite.
All of it, custom roms dont help at all. For example custom roms dont solve their broken implementation of verified boot or how they used public keys for verified boot. In addition custom roms rarely go out of their way to add security patches that the OEM hasnt added themselves. For example, GraphineOS relies on Google to publish security patches in a timely manner for them to keep GraphineOS secure. GraphineOS can trust Google because they have a proven track record of publishing open source security peatches in a timely manner while Fairphone has proven to be the exact opposite.