You cannot put custom firmware. If spyware is hidden in drivers, bootloader or even firmware of the modem there is nothing we can do about it. Custom ROMs are just replacing things above the kernel and below apps.
Still of course things average non CIA person should not worry about. Google apps with high privileges are removed with custom ROMs.