project mainline: security updates and some system components updated independently of OEM after EOL
safety net / play integrity
look & feel is on a higher level than an average custom ROM
years after EOL, majority of apps will still support the ROM, kitkat is loosing support from play services this year, majority of apps target lolipop.
Custom ROM:
fun with tinkering
risks, worries, time spent
more updates
hit & miss -> either better or worse battery life, these are often targeting middle-school boys fanatic about anime, overclocking destroys heat management and battery life, safety net can stop working any day
sketchy hacks to get some services for free etc.
nice hacks to get 80% battery charging limit, underclock, automate tasks
huge fragmentation and duplication of effort that leads nowhere among tons of ROMS, competition among them does not do any good currently as they have no incentive to compete
unlocked bootloader -> less security when it's confiscated; but some people are able to lock the bootloader on a custom ROM.
on one hand increased privacy, but not many people audit custom ROMS, so they pose higher security and privacy risks.
I just scratched the surface, but I think custom ROMS have failed people like me who value having no worries about safety net limiting their contactless payments, cards for public transportation within apps, those who value battery life and love underclocks, professional look instead of kitsch, peace of mind, features out of the box like dolby atmos, additional features from the OEM like gesture screenshots, scrolling screenshots and a lot other features.
Regarding security: as always, it depends on your threat model. If you fear a government actor getting access to your phone, a locked bootloader won't slow them down.
Regarding privacy: I've had both VPN logs and external Wireshark running against traffic going in&out of my custom ROM phones & sometimes I still do it for fun. If you know what you're getting into (e.g. LoS still using some Google services) then a Custom ROM usually holds far fewer surprises than some questionable OEM ROM (and which is terrifyingly scarce regarding changelogs while still having OTA update power).
tl;dr: stick with well-known ROMs & you get ... not the best of both worlds ... but a "good enough" of both worlds.