PrivateLoop Given you've said that virtualization is more secure than GrapheneOS's exploit protections, and that "Whonix was designed for, eg remote attacker trying to deanonymize you", wouldn't that make Whonix almost always a better choice?
No. Whonix is a very special purpose operating system, so for many use-cases Whonix would not be suitable. For example, Whonix does not provide any meaningful isolation between apps inside the workstation, only between the workstation and gateway. So you cannot use Whonix as a regular operating system and hope you get any real security, you specifically need to use it for domain isolation / compartmentalization, or it won't really give you much.
PrivateLoop I am not sure if this is enough for a threat model:
In a threat model you want to define who your attacker is, and what you worry they might do. Who do you want to stop from doing what?
For example, you might want to visit and post on a certain website anonymously, but the things you post is a severe inconvenience for your government or some criminal gang or some other group that could do you serious harm. You worry they will attempt to hack you when you login on your account using Tor Browser, in order to deanonymize you by disabling or bypassing Tor, and expose your real IP address or geographical location. So you use Whonix, and only have things related to your anonymous activity on that website inside your Whonix workstation. If the Tor Browser gets hacked, they can only access files within the workstation, which is only things that already are or is going to be published on that anonymous account. There won't be any identifying information about who you are, no hardware identifiers, and even if they have fully compromised the workstation, they cannot bypass Tor or even find out which Tor guards you are connected to. They would need a virtual machine escape vulnerability, which is very hard to find and use, and extremely costly. Here the strong isolation between the workstation and gateway is super important, but the fact there aren't much protections within the workstation matters less.
Or you might be an activist working with a stigmatized and marginalized minority in society. If members of that minority becomes known, they will be harassed and possibly even assaulted by other citizens while the police looks with a blind eye, letting it happen. You as the activist have contact details to many members of this minority and know who they are, so you can help them. You also have end-to-end encrypted chats on various messaging apps with them, with chat history. You need to be able to communicate with them while on the go, so your device needs to be running most of the time. You worry that someone will realize you work with this minority, which is likely since you are rather high profile, and that they will attempt to get physical access to your device, or hack your messaging apps, in order to expose the members of this minority. Here Whonix would be a very poor choice, as Whonix does not do anything to harden messaging apps from being hacked, does not do anything to prevent information from other messaging apps running on the same machine from being obtained by a hacked messaging app, and does not provide that much physical security at all. GrapheneOS on the other hand would be a perfect fit. GrapheneOS hardens the messaging apps you run in various ways, including MTE, which means vulnerabilities that might exist in the messaging apps may not actually be exploitable at all on GrapheneOS even if it is on other operating systems. This protects your other chats in that same messaging app from leaking. GrapheneOS also isolate apps from each other using app sandboxing, so if one messaging app gets compromised either way, the contacts and chat history in the other messaging apps won't leak, nor will sensitive real life contact information you have stored in regular files. If you phone gets taken, there is also two-factor unlock, auto reboot and duress passphrase and other functionalities that help making sure they cannot get in.
Who is your attacker and what do you worry they would do? What consequences would that have to you? When you know that, it is possible to start choosing an operating system, apps and a way to use it all that is the most secure for your use-case.