Pixels get verified boot and bootloader relocking for custom roms like grapheneos as well, so you can be sure your device isn’t compromised even with a privacy respecting custom rom. I guess this is what most people refer to… Oh, and Pixels are probably going to get security patches for the kernel as well as the vendor blobs unlike many other vendors…

I hate being forced to use this crap

For security, disabling the root account is important, so be sure to add --no-preserve-root on the end!