Has to be unfortunately. Simple reason is only a Pixel supports every firmware and bootloader level security feature for third party OS's. For most Android phones you must keep your bootloader unlocked which is a big security risk.