Lineage is degoogled (assuming you don't have the gservices installed) graphene does something with isolating all services so that no apps have extra privileges (there is probably a lot of details I'm missing) but basically I understand it as more secure for that as well as being able to lock the bootloader after install.