Custom ROMs will receive upstream Android security patches but not patches from proprietary components (firmware). For instance, my Moto g7 power has Android security patches from May but the latest vendor security patch level is 2021. I'm curious to know if the older firmware is a problem. I don't think it is easily exploitable outside of government backdoors. Not that it matters much as I plan on keeping my phone until it dies.