I sometimes wonder whether the recurring "this app needs to be very secure" argument these kind of apps push is less about applying the strongest security practices, and more about risk transfer and accountability.
From a public-sector sponsor’s perspective, relying exclusively on mainstream platforms (Google-certified Android / Apple iOS) would make post-incident narratives much simpler: if something goes wrong, responsibility can be deflected toward a large, industry-standard tech and/or vendor.
By contrast, supporting a hardened but non-mainstream OS like GrapheneOS removes that safety net. Any vulnerability would be surgically analysed in depth by a technically competent community, and shortcomings in the app’s own design or implementation would likely be identified very quickly, leaving far less room for external finger-pointing... particularly when the response is likely to come in the now famous GrapheneOS form of a blunt, evidence-based technical breakdown rather than a carefully worded public-sector damage-control communiqué.
IMHO, "security" here may be conflated with institutional defensibility, not necessarily with objective technical robustness.
Fingers crossed though that internal AGOV lobbying from technical experts conveys courage to Leadership.