GOS fits into pretty much any threat model where you remotely care about privacy or security
No, it doesn't. It obeys Google's long-term development strategy for the OS. Google and privacy are absolutely incompatible. See: https://news.ycombinator.com/item?id=29502439
This is true.
Many more care about neither,
or intermittently care about neither,
than most take into account.