Will flashing LineageOS on a Xiaomi phone prevent it from collecting user data and possibly sharing it with the Chinese government?

[archerallstars]

@KDEBacon

This is not an issue as user data is encrypted

This goes far beyond just the encryption, since an attacker can trivially flash partitions without risk of erasing user-data (according to DivestOS FAQ), I would assume with the altered/compromised system, the encryption wouldn’t last long, e.g. brute-force the password, etc. All of that with a persistent after reboot compromise, which would not be the case with locked bootloader.

The security issue with an unlocked bootloader is HUGE, which you can read about this:

• A fundamental part of Android security model.

• Depending on the device, you could bypass the encryption altogether, thus granted access to the phone and all user data.

• A successful (recovery)case with an unlocked bootloader phone, in which all user data is accessible regardless of the user password, encryption, or whatsoever.

Edit: I just found the source of the first link above, here - madaidans-insecurities. The source is not only talking about the security issue of the unlocked bootloader, but also rooting, custom ROMs, MicroG, firewalls, etc. It’s a good read overall about Android security.