graphene sandboxes Google services so they don't run as root on your device. I haven't encountered an app I can't get running on graphene yet and having Google play installed as non root is a far sight better than stock.
my biggest problem with lineage was compatibility with banking apps so I reluctantly switched but graphene is a solid choice in operating system for privacy and security.
not really. after enabling oem unlocking in developer options you just boot it while holding one of the volume buttons and you're able to unlock the bootloader.
root is not typically available and you don't need it for most uses besides development, but even then, I would recommend not using a phone you daily for that.