True, security seems to be the main reason. But while desktop linux is community driven, AOSP is controlled by Google. So long-term, GrapheneOS is at the mercy of Google, no matter what. And also in terms of security, Google is becoming more hostile, where since a while, the GrapheneOS team is not allowed to publish all security patches source code in a timely manner: https://discuss.grapheneos.org/d/26476-backports-quarterly-r...