Curious Anyway may I ask why did you chose GOS and what makes you and how much do you trust the project and people around it?
I didn't use to trust smartphones at all. I had an iPhone, but pretty much only used it for digital ID and bus tickets. Nothing private at all ever touched that device.
But I wanted a portable media player, that had strong disk encryption, and no connectivity at all. I decided on getting a Linux phone. I bought a Pinephone and installed Mobian on it. It has strong LUKS2 encryption which hides all data including metadata, since all Linux distributions do, and the Pinephone had hardware switches, so I could just disable the cellular and the Wifi modules. I didn't care much for the reputation of either Pinephone nor Mobian, as it would only be used offline.
But things never turn out as one expects. I ended up installing a Matrix client on the phone, and soon I discovered just how convenient and helpful it is to keep in touch with both friends and activism initiatives I am in by having a phone. Rather than checking for messages once a day, I now had a phone LED that would flash as soon as there was a message to me. So I started using the Pinephone as an online device instead, always turned on, and it was never used as a media player.
But I felt very uneasy about it. The Mobian project weren't good at all in getting out kernel updates or Wifi firmware updates, sometimes lagging behind by half a year, and kept talking about how they might need to drop support for the Pinephone entirely, because it was too hard for them to maintain at all, even ignoring security issues. Furthermore, the Matrix client was written in C++, and as I used it for activism, the likelihood of being hacked is very real. I also wouldn't know what internet facing apps might attempt to read my files. So I didn't dare having any sensitive files on the phone at all. For internet usage, I just didn't feel I had any control at all.
So I went looking for another solution, and found recommendations on GrapheneOS running on Pixels. However, this time around, security and trust was very important for me, but unfortunately, no security project I already trust vouched for or recommended GrapheneOS at all. So I felt a bit left alone in trying to find trust in GrapheneOS. My idea was that I would do security domain isolation, keeping all my activism activity separate from my usage of the device as a media player separate from my usage of the phone for digital ID and bus tickets. So if either domain gets compromised, the hacker will not be able to obtain any information from the other domains. I already use QubesOS, so I know how an ideal implementation of security domain isolation would look like. And reading up on GrapheneOS, the sandboxing of file permissions and internet permissions on the one hand, and no IPC between user profiles on the other hand, seem to enable something that looks like an acceptable albeit not ideal implementation of security domain isolation. And GrapheneOS also seemed to be very serious about getting kernel updates and firmware updates out very soon, including general hardening.
So it really came down to GrapheneOS seemingly having the security features I would need.
But trust is hard, so I ended up auditing GrapheneOS using wireshark and root shell access too before finally choosing to trust GrapheneOS for my use cases. At that point, I had a pretty good idea of what kind of security weaknesses is in GrapheneOS. I have also reported some issues myself, and some of those have been solved by the GrapheneOS team now, showing they take reported security issues seriously. They also plan to solve the remaining ones, but cannot promise any time plan since way harder to do.
I think, after having used an operating system for a while, one tend to get a pretty good idea of what strengths and weaknesses that operating system has, especially if one actively follow discussions, the bug ticket tracker, and audit things oneself. But even before that, having a clear picture of what security features one need oneself could guide one in making an initial choice.
I am still keeping my eyes open for a mobile phone operating system that implements strong security domain isolation similar to QubesOS, but unlike QubesOS, where each domain can be put at rest independently from each other in case my phone gets taken while turned on. That would be ideal for me.