GrapheneOS will always choose security over privacy, even if that means playing into the hands of malicious actors like Google. For example they have stated they won't try to spoof SafetyNet because "we don't lie about security features"

I personally would prefer to have both but choose the privacy side when both are into conflict.

Both viewpoints are valid, but I don't use GrapheneOS for this reason.