Not every threat model requires the security level GrapheneOS provides. My threat model ends with Google and other big corporation shouldn’t spy on me and if I lose my phone anyone finding it shouldn’t get in and be able to steal my identity. I think DivestOS and CalyxOS do a fine job with that.