GraphoneOS is designed and developed to be secure. When Google stops updating a device, GrapheneOS is forced to do the same since it will become less secure as time goes on. Because of this only images for currently supported devices are provided and older versions are removed and will not be provided.
Getting it from some random person is very much not recommended since you will not really know whether it's the real deal or of it has been intentionally compromised (saying nothing of unpatched security risks).
But just tossing a fully functional phone that you have a use for is a waste. So for a low risk scenario, I'd instead recommend DivestOS which supports a wide range of devices and releases mitigating security patches monthly.
Do note that it should not be considered secure — the patches are intended as harm reduction to make the best of a poor situation.