Here are the 170+ kernel CVE patches applied on top of what Lineage provides for Pixel 2 series: https://gitlab.com/divested-mobile/divestos-build/-/blob/mas...
Plus it just provides updates quicker, eg. the recent WebP CVE was first fixed in DivestOS before other aftermarket systems. https://divestos.org/pages/news
And provides rapid out-of-band WebView updates: https://divestos.org/misc/ch-dates.txt
See my other notes here: https://divestos.org/pages/patch_levels#osSecurity
And also this independent table: https://eylenburg.github.io/android_comparison.htm