Thank you for your answers.
Tryptamine It seems I have to build a userdebug build to do some of the things I want. I'm not going to read the code to figure out what the system does, but rather test the running system. I prefer to inspect the running system to understand how it works, it is easier and faster than reading code, and is the typical way one spots mistakes and bugs anyway.
boldsuck I don't think I will go as far a trying to decrypt the TLS traffic, I just want to see things that all traffic really goes through VPN or Tor when I expect it to, and if VPN is interrupted no traffic goes out at all. And see that no network traffic is generated by apps unless I expect it to be done, even if I use all the functions in the apps. And that disallowing Network permissions really works and so. And that connections only go to servers I expect it to be done to for networked apps like chat apps. Like, really basic checks so I can feel confident my data and files aren't being sent out somewhere, and that I really am in control like I am supposed to be.
For capturing raw network traffic, apparently I can do a userdebug build, and run "adb shell" and then "su" in that shell and then "tcpdump" to produce a PCAP file for any real network interface. I will try this out.
And I heard MTP is the only kind-of secure way to transfer files, but both devices have to be trusted. I couldn't get MTP to work for me, but that is probably a Qubes OS bug, not a Graphene OS bug.
de0u Thank you for the links, I thought I had read all that already, but it kind-of answered some of my questions, but not really fully. I will poke around a little using "adb shell", possibly using a userdebug build, and hopefully I will learn better how the security is really implemented and what guarantees I really have. I am totally new to Android like systems after all. Seems separate user profiles for different security domains are the safest.