Up to date custom ROM vs outdated official ROM: which is more secure?

Up to date custom ROM vs outdated official ROM: which is more secure?

Question 1:

Which is more secure between an up to date custom ROM and an outdated official ROM ?

Question 2:

If an up to date custom ROM is more secure, why is Google making it harder to pass SafetyNet on them than on outdated official ROMs ?

Details:

Up to date custom ROM:

• Android security patch: latest
• Google Play system update: latest
• Bootloader: unlocked
• Rooted: no

Outdated official ROM:

• Android security patch: 2+ years old
• Google Play system update: latest
• Bootloader: locked
• Rooted: no

Threat model: average user with several banking apps