Comment by chasil

You don't have to.

This is the most secure option:

https://grapheneos.org/

This is more flexible and will give you root, at the cost of an unlocked bootloader:

https://lineageos.org/