

rooted
Root is always a security risk, you really should not. (GrapheneOS comment (on Reddit) about rooting.)
out the box
None, probably. Refer to Bootloader Unlock Wall of Shame instead to check which companies do not restrict bootloader unlocking. See here for a list of devices where the bootloader can be locked with custom AVB Keys.
Why I recommend against Brave - Luca Bramè.
This article is a pretty good breakdown of why you shouldn’t use Brave.