If you don’t boot into Android userland after installation and check get_unlock_ability right before locking it’s really not that much of a gamble. Even with an unbootable system / mismatched security patch level you can unlock the bootloader at that point and try something else.
Without knowing the current SPL I’d always point towards ROMs that get updated to the newest one as fast as possible, Calyx and Divest are certainly great choices.
There are certainly other ways to mess up an installation that will render the phone unbootable (Magisk comes to mind, messing with partitions, etc.) and if get_unlock_ability was reset e.g. by booting into the system that would result in a brick.
But as @yvmuell rightly pointed out this still comes down to SPL most of the time. It’s just that we initially thought (or me at least anyway) that the reset is the bug, which no one at Fairphone bothered to clear up for months (and still havent). Combined with the fact that the factory images provided by FP at that time were frequently at least one version behind that lead to people bricking their phones. Some even got told by support to flash those…
Anyways, SPL not getting reset is the bug, get_unlock_ability getting reset on first boot is a “feature”.
FP still could make this safer for people by adding a note about get_unlock_ability in the tutorial, setting the install script to not reboot automatically, or provide a proper installer that checks for that and guides people through the process.
But I’ve said that several times before and apparently that’s too much to ask 