JPN_Tales
There might be a misunderstanding about the word "forced". Technically, one can stay at the current version, by just disabling automatic updates. (Although I'd strongly advise against it.) With deep technical knowledge, one might even fork GrapheneOS, follow every new security publication on android systems and attempt backporting whatever patch is possible.
Side note: To some extend, the developer of discontinued DivestOS (cp. above, https://discuss.grapheneos.org/d/23080-aosp-and-pixel-device-support/19 ), attempted this herculean task.
But I assume, you'd prefer to stay at an older official GrapheneOS-version and just get official security updates, not developing and porting everything on your own. I can understand that. However, it probably would neither be feasible for a small project nor reasonable -- if one aims at very high security standards.
I'm not sure If i can give a real, deep answer to the "why". My attempt: Its because GrapheneOS is based on AOSP, but also on certain security hardware and appropriate support of that in terms of firmware/drivers/APIs in the OS. For both, a huge amount of the development is done by other developers -- and mainly happens for the most recent branches of Android (upstream). So, if one wants to implement and publish the newest security fixes asap (and is no superhuman developer) one only gets it realistically done by closely following the most recent upstream branch.
Also compare what DivestOS developer once wrote about on OS security: https://web.archive.org/web/20241223172430/https://divestos.org/pages/patch_levels#osSecurity
(Again the caveat/"Disclaimer": That article is from an archived, discontinued site. No guarantee that any reports there are accurate and still valid today.)
Does this answer your question?