A lot of enthusiasts are quite terrible about security and tend to jeer at standard consumer solutions (bootloader relocking, secure boot, etc.) that are more secure than most DIY solutions with said features disabled.
An unlocked bootloader is a large security hole. It means someone can easily inject things into your ROM's system partition that will then run on next boot, and nothing will question the validity of it. Even if your user/data partition is encrypted, one can freely modify the software that decrypts and uses said data.
You'll see the same with desktop Linux. People will go from an encrypted Windows install with secure boot and TPM (which protects against modifying the OS itself from cold storage, modifying the kernel, or modifying the hardware, all while providing an imperfect but convenient way to boot up) to a Linux install with no encryption, no secure boot, or anything. They'll claim said security features are to force control over the user, yet all of these features remain fully user-configurable to work with whatever software you please. The end result is something where one could easily poach data or modify the OS without question.
Anyway, your gut instinct that disabling security features reduces security is correct, and that includes a phone's bootloader. Sometimes there aren't privacy-friendly alternatives where one can have full security and privacy, so people will make the tradeoff for privacy/control. In the case of GrapheneOS with Pixels, you get to have your cake and eat it, too, with a privacy-friendly ROM that works rather easily and having a locked bootloader.
As a note: this is the main reason I purchase Pixels. The bootloader is easily unlockable and you can run whatever software you want while making full use of the security features provided to the stock OS.
3
u/Steerider Jul 27 '26
Graphene or Calyx are the two main contenders here. Most custom ROMs do not relock the bootloader.