Lineage is as much standard android experience as you can get after market without any gaming/styling mods. If google was series about AOSP and sustainability they should embrace lineage and at least give a non-rooted lineage with a relocked bootloader on pixel phones a safety-net pass. Lineage has been very careful to not piss off google by not including microg or alternative webview signatures or means to circumven…
DivestOS is a slightly modified Lineage version that officially supports relocking on some phones (in contrast with Lineage, which I think can be relocked but explicitly tells users not to do that). It also has sandboxed implementations of both official Google services — ported from Graphene, I think – and microG. I'm using it with microG, bootloader relocked, and it seems to pass SafetyNet this way – at least the ap…
They set the vbmeta header flags field to 0x3, which effectively turns off all of AVB (Android Verified Boot). I'm guessing they do this because they want to allow the system partition to be writable (eg. for folks who flash additional things on top of LineageOS).
With unmodified LineageOS, if you configured the bootloader to use LineageOS' public key and relocked it, there would be no security benefit. To enable AVB's signature checks, the flags field needs to be set to 0, which requires re-signing LineageOS with your own key.