Block-cipher use self-inverse ($f(f(x)) = x $) operations which then will be applied to the plaintext and most likely contain some constants which can be based at a key. To get security such operations which interpret the input in different ways are aligned to each other. This process gets repeated multiple rounds with different keys. In optimal case a random input lies inside a closed cycle (if block-cipher applied over and over again) with a random cycle size (uniform, given random key).
By testing around I noticed this can happen with just some very simple operations of XOR, Bit-Rotation and addition. (called ARX)
E.g.: for one round with input $m$:
$$ m = XOR(m, R_i) \\ m = RotateBit(m,5) \\ m = m + K_i $$
$R_i, K_i$ are round keys for round $i$.
XOR alone is not secure because that operation is just at single bits without impact to each other.
Bit rotation is added to increase the impact of a single bit to every other bit. At its own also not secure because it has only impact at single bits each
Addition is added as as 2nd kind of input interpretation (as number instead of bits). Here the bits can impact each other.
With this I got some good (but not perfect) uniform distribution of the different cycle lengths (given random key and input).
The question is how many rounds need to be applied for security? It need to be at least the total bit-size so every bit can reach every other position due to bit rotation.
Here is some related thread for AES.
But as a more general metric (for custom block-cipher) can the security measured with the impact of a bit change in the input to every bit of the output?
In optimal case every possible bit change of every possible input should lead to 50% different bits at the output (with each bit being different to same amount).
The round number can be increased until it reaches a suitable level of security.