Daniel Micay is also no longer the head of GrapheneOS.
Then why is he the only one making any commits to this AOSP fork project on GitHub? You fell for his tricks too, like most.
Android devices in general are very good against security risks at this point, since Android 9/10 came. Android security continues to get solid across all devices at this point, with Android 14 release. Anything that is close to or stock is going to be very solid, and then it depends on competition evaluations like in BlackHat Pwn2Own every year. Pixel, Huawei/Honor, and Sony/Moto like stock phones tend to do very well, while Samsung, Xiaomi have issues due to lots of cruft and custom APIs they make in their skinned phones. Apple does well but iOS is insecure compared to Android.
I should clarify that sandboxed Google Play means practically nothing. You can use AppOps and neuter its permissions and achieve same effects of privacy and security on any non rooted phone, where only IP address and pings for Google certified SafetyNet device number is attained by Google, if you choose to use GMS.
Most of the security measures are something you can take with lots of Android devices, and is nothing exclusive to Pixel/Graphene fairy tales. Micay and his minions just love selling that combo as the only solution, and I frankly hate it as it has no basis in reality.