LineageOS relies on the open source kernels and pre-existing vendor blobs to run. Qualcom drivers and such won't receive any patches, the best you can hope for is that the driver blobs are extracted by the device maintainer and put into the next build.
As for the Android stack itself, LineageOS follow the upstream Android branches very closely where it can. Most vulnerabilities in that stack will probably be shared among devices, so security issues will probably be fixed within a reasonable amount of time. Google's Android patches should also be present in the nearest weekly updates after public release.
The lack of official driver and kernel patches make the security of LineageOS a little strange. There are definitely some patches that LineageOS can apply, but in the end they rely on the vendor to publish all the necessary patches, and that can take a while.
There's also the fact to consider that out of necessity, the bootloader on the phones is unlocked. Most phones won't allow you to lock it again with your own keys (if you try, you'll often brick the device!) so it's trivial for a malicious actor to flash a new OS full of spyware and key loggers onto the system partition.
Having said that, LineageOS supplies weekly updates to my Oneplus One, even though it's showing its age. Neither Qualcom nor Oneplus will ever release any more patches for this device, so for kernel level security I'm boned. However, I still get the latest and greatest Android 11 framework security patches. This should protect the phone against the huge Bluetooth exploit found a few years back despite it being over eight years old now.
LineageOS is quite transparent about this, even showing that their device is missing patches right inside the settings (https://www.xda-developers.com/lineageos-trust-centralized-i...). I don't think you can expect much more from a project run by volunteers.
My daily driver phone receives "quarterly" security updates (sometimes off by a month or so) so I'd rate LineageOS above Xiaomi in this sense. The LOS Android stack itself should also be on par with or even better than some flagship phones.
Sadly, for the complete picture, Qualcom and other manufacturers determine how secure LineageOS can be. In general, the bootloader lock status and lacking supply of source code are a real pain for open source efforts. Some phones may see a mainline kernel with all of the recent Linux patches as a result of the postmarketOS efforts (https://wiki.postmarketos.org/wiki/The_Mainline_Kernel) but cleaning up vendor code and reverse engineering drivers isn't exactly a fast process.