[OnePlus 3T Questions & Answers] Dirk:
Magisk is the root method, and also used to fix Safetynet issues. You would need TWRP installed though.

Locking the Bootloader right now will fix the issue you are having. It will also factory reset your phone again, so be prepared for that.

That said, installing TWRP is easy if you follow the guides carefully and avoid the obvious pifalls, or simply trying to use the wrong TWRP is a common issue.

In case you still want to try LOS:

This TWRP:

Download twrp-3.3.1-0-oneplus3.img

Follow this guide from funkwizard:

Flashing TWRP Recovery

Adjust the following settings on the phone:

USB Debugging:

On your phone go to Settings > About phone > Tap on Build number 7 times. This will enable Developer options. Now go back to Settings > Developer options > Enable USB debugging

Enable OEM Unlocking:

On your phone go to Settings > Developer options. Then enable the 'OEM Unlocking' option and make sure that from now on, OEM unlocking option is enabled before you reboot. Sometimes, it might get disabled itself.

Enable Advanced Reboot:

On your phone go to Settings > Developer options. Then enable the 'Advanced Reboot' option.

Place TWRP image in the Platform Tools folder in C:\adb

Then boot into fastboot/bootloader mode on your phone by holding volume up + power or selecting the reboot to bootloader via advanced reboot options.

Open a new command prompt in the platform tools folder and run the following command:

fastboot flash recovery (file name).img

Once the flash has completed, Don't use the "Fastboot Reboot" Command Instead unplug your phone then Manually boot it into recovery by keeping Power + Volume Down button pressed, or you can also use the command:

fastboot boot recovery.img

/Guide.

Just to be clear, when you fastboot flash the TWRP image i linked you to, the command will be:

fastboot flash recovery twrp-3.3.1-0-oneplus3.img

Make sure your phone is actually in fastboot mode when you do this. Just follow the guide. (On Windows 10 a command prompt window can be opened in the platform tools folder by typing 'cmd' in the Address Bar in that folder, using Windows Explorer).

Once you have flashed TWRP, you do need to boot straight into that Recovery. If you boot into the OS, the stock Recovery will overwrite TWRP again. (follow the guide).

Once you are in TWRP, swipe to 'allow modifications'. (If you decide to go down the custom ROM path you will need to Format /Data and Wipe Partitions, then connect to your PC and transfer any zips you need to install to Internal Storage).

You will have to decide for yourself whether you want to be rooted with Magisk. While it can be used to fix Safetynet issues, it's not needed for that. If you want root access, flash Magisk. If you don't want root, don't. Simple.

Let's say for arguments sake you don't want to be rooted and have sucessfully installed TWRP. Next step would be to install LOS. Assuming you want a stable ROM, it would be LOS 16 you install. So you would flash the latest build of that along with Gapps and the second Zip in this post:

https://xdaforums.com/showpost.php?p=78433987&postcount=3 which is:

https://drive.google.com/open?id=1Yy...2YSyxEXNXWolH5 (sec-patch-2019-08-01.zip)

That zip takes care of one Safetynet problem. (CTS Profile).

Once you have LOS setup you can relock your Bootloader. That then takes care of the remaining Safetynet issue.

Clear Cache/Data on the Play Store App and reboot. Use the 'Root and Safetynet Checker' App to test Safetynet status. Once it shows 'Passed', Netflix and Banking Apps (Including Google Pay) that rely on Safetynet will all work.

Or stay on OOS and relock your Bootloader. Only you know what you want, although it seems that after our previous discussions you are ready to dip your toes into the custom ROM scene. Don't let some early setbacks deter you. You're almost there. :)