matchboxbananasynergy I am skeptical that at the end of the day QubesOS would be overall more secure against exploit than a modern Pixel with GrapheneOS. If the main argument is the absence of a modem, the Pixel Tablet would fill that role. Granted, the tablet is 7th gen and therefore lacks MTE, but QubesOS doesn't have that either.
GrapheneOS is not isolating kernel drivers at all. If one of those is compromised, the attacker can bypass all other security in the system. Hardening, including MTE, helps, but QubesOS isolate the radio drivers in their own virtual machine with access to nothing. The attacker would have to do the equivalent of hacking a GrapheneOS driver (but easier since less hardening), and then also hack the hypervisor (super hard).
Same if the attack vector is through an app. On GrapheneOS, the attack surface is the whole Linux kernel. The sandboxing in AOSP and thus GrapheneOS is relying on SELinux and similar "blacklist" functionalities. It is not even on pair with Linux sandboxing, which still have a huge attack surface. But on QubesOS, if you put an app in its own qube, the attacker would have to find an exploit against the hypervisor to get access to anything else, which is super hard.
Although number of found exploits is not a super reliable measure of security, it can act as proxy. QubesOS report having patched 1-3 exploit vectors in the hypervisor and glue code per year. AOSP report having patched a similar amount of sandbox escape vectors each month.
With that said, QubesOS have almost no security against physical attackers.