You can lock the bootloader again after the flashing process is done(because it will add the signing key of the new OS), but unfortunately the NFC Payments in Google Pay still won’t work because Google only allows it on ‘certified’ Android systems (aka only the preinstalled OS)

It was possible to download lossless FLAC files (they got them straight from Deezer) though, so higher quality than anything downloaded from Youtube etc.

Did you read the sentence before that? A malicious website could read data from other websites(opened in different tabs), and also passwords stored in the browser, etc… There is no additional system exploit needed for that

Here you can find a good explanation on that.

Mull (from the DivestOS developers)

But nowadays I’m using a Chromium based browser on my phone because Firefox on Android doesn’t support process isolation