You do not need to root or put a custom recovery for any of what you want.
A ROM is not a widget but the entire Operating System
Custom Recovery is only needed to flash said ROMs. Otherwise it serves no purpose.
Widgets are in plentiful supply on the play store.
If you want to turn off auto-updates you can do so in the play store for your downloaded applications, and if you don't want to be bugged about software updates regarding the Operating System, simply go into applications management in settings, then go to all apps. Scroll down to Google Services Framework, click on it and untick show notifications.
As for lock screen, sadly widgets / shortcuts are not available with pin lock - only with swipe lock. But you can change the pin lock time by simply changing the screen timeout in display settings. Every time your screen tines out after 5 additional seconds the pin lock will kick in.
----------
Yep there is nothing like begrudging developers ad revenue so that they are actually paid for their hard work developing an app and offering it free on the app store. Heaven forbid anyone with a conscience would want to pay a developer to unlock the ad free version if they were going to use the app regularly....
/s. Sarcasm - but I do strongly believe in paying for an app if you don't want ads. We have $500 + phones, I don't see a valid argument to deprive a developer of the $1 for an app.