The promise of locked bootloader. Later I learned that Lineage does the same job, they sign their builds for AVB. Though their documentation sucks and forums full of idiots screaming "NEVER LOCK YOUR BOOTLOADER".

Regarding "privacy" - I'm not really sure how much work is done in Calyx. Well, you may choose cloudflare dns out of the box and you have a "firewall" (just a better fronted to android permissions API). Though you can perfectly get that on Lineage. Lineage has its telemetry but you can switch it off.

Actually I'm thinking about building my own lineage-based distro (with proper call recorder built in), that's not that hard. Though for now I don't want to invest too much time into that.