I think system apps are basically baked into the OS/ROM image (probably not the right term, but you know what I mean) which is why you can often only disable them - that’s how they’re there in the first place, they need to still exist somewhere so they come back on a factor reset. Don’t know if a system update would necessarily bring them back though.
Unlocking the bootloader to install a ROM and then re-locking it is fine (I believe that’s what GrapheneOS does at least), just don’t leave it unlocked when you’re done. Root is the big security vulnerability so best not to have it unless you really really need it and are willing to take the risk. I don’t think you need a bootloader unlock for installing any apps though, isn’t fdroid just a normal app install?