[About XDA developers] riboslavin:
To answer some of these questions, it might help to fully understand what we're talking about.

What kind of security issues face an Android phone?

Well, for one, there are network-level attacks. This are fake cell towers (sometimes called Stingrays) that can collect the sort of data a cell tower might be able to collect, your location, your messages, and your data.

A third-party ROM or a rooted phone is not intrinsically more vulnerable to this. In fact, there are some apps that help detect this kind of attack, and those apps will generally require root access. This kind of attack is less likely to be a random skiddie, and more likely to be the police or a government.

Another kind of attack is a malicious app. Think of it like a trojan horse, something you willingly let into your phone, and it has a secret malicious payload. Maybe it's a browser that actually skims all your activity to sell to marketers. Maybe it's a widget that shows a neat clock on your lock screen, but it actually collects all of your contacts so they can be spammed later.

Since this would be an app that you've willingly downloaded, a third-party ROM doesn't make you much more susceptible, but granting this app Root could make it much more damaging, since it could hide itself from uninstallation or even modify other apps to do bad things.

Note, though, that certain third-party ROMs and apps that require root can help protect against this. If you download an app, and it says it needs permissions that don't make sense (why does a clock app need access to my camera, or my contact list?), that should be a red flag to not install it. But some ROMs actually let you revoke/block individual permissions., so if a baddie app was trying to access stuff it shouldn't, you can stop that from happening.

But there's a slightly more insidious kind of malicious app. Imagine third-party app that accesses Twitter, or Snapchat, or Instagram. Now this app actually saves all of the things you're doing elsewhere before it punts them off to the service you're trying to access. This app could be appearing to function completely honestly, hoarding your Snaps and your snapchat password, until one day they decide to leak all your snaps, or upload all the images you sent to your private Instagram to a public site.

You're not intrinsically more vulnerable to this kind of attack with a third-party ROM or a rooted phone. These apps will likely be come from a non-Play store source, which can happen even stock/unrooted. An app like this with root access can do more bad stuff, but their wheelhouse is in doing bad things with the data you've already willingly given them, so it's moot.

Then there's the issue you seem to be most worried about, which is malware baked into a ROM. This is by far the biggest danger in terms of risk, because it could be doing all sorts of nasty stuff relatively invisibly. What prevents someone from doing this, though? Well, for one, with an open source project, everyone can see the code. If there is something flagrantly wrong, it could be spotted by other people. It's possible to try to hide it, though, and some smaller ROMs don't attract a ton of eyeballs, so not that many people might be looking.

Then again, plenty of major ROMs could have the same thing going on, just in very clever or subtle ways. Look at how pervasive the Heartbleed issue was, and that was in code that tons of very smart people had the chance to look over.

Third-party ROMs do present more danger in this regard. What do we consider third-party, though? Major carriers lay tons of extra code on top of vanilla Android. And plenty of them may be doing unseemly things with your data, either for marketing reasons or at the behest of someone like the NSA. In that case, you're best but would be to stick strictly to AOSP ROMs, but even then, it's not a sure thing.

Truth be told, the best thing you can do for security is just pay attention to what you're letting onto your phone, and what you're letting those apps do. Your choice of ROM and root status is a part of it, but being generally aware is by far the most important thing.