GrapheneOS not backed by any evidence and contradicted by leaks. The burden of proof is on you.
Oh, okay, you can make a baseless claim, but I can't? Because you still didn't answer/shown any evidence on how exactly do you know that Google isn't sharing information on vulnerabilities with the intelligence agencies before they share it with OEMs?
Also I agree to a degree that claims should of course provide evidence. But especially in security and privacy, just alone remembering for example Edward Snowden, that before his revelations, some people knew that something was going on and to a degree even what was going on, but just because they didn't had the proof (or were afraid to share it) didn't mean they were wrong and history has shown it many times.
Especially regarding the intelligence agencies, we got the problem, that many things (not all obviously) will turn out the way how we think it is, but the hard facts for them often come to light many, many years later. So I also believe in providing proof, but that topic is not a black and white issue.
GrapheneOS You only need to do basic critical thinking to see that you're thoroughly incorrect. All of the patches which are under embargo are for vulnerabilities in open source code. You have all of the open source code with those vulnerabilities. If open source works the way you believe it does, then people should be able to find and fix all of these vulnerabilities very easily. You don't need the patches for the open source code because you already have the open source code, and according to you that means people will find the vulnerabilities or backdoors in it. Therefore, it should already all be found and fixed already. Why are there still security vulnerabilities being fixed in open source projects if it works the way you believe?
There is still a big difference:
While it is true, that open source is not perfect, it's still less likely that either a backdoor in general, but especially a really bad backdoor, can be implemented, or if implemented, that it will be found very late, especially in projects that are already somewhat big and additionally focusing on privacy and security like GrapheneOS. Only to very small projects, that also don't even have anything to do with privacy or security in general, the advantage of open source doesn't apply very strongly. But GrapheneOS as I see it, wants to become even bigger in the future, so here comes the advantage of open source into play very strongly.
But with closed source, there is probably a 99,9 percent chance, that it's possible for the intelligence agencies to make up a plan to force you into putting in a backdoor that would be probably very bad, judging by the available ressources of the intelligence agencies.
So like I said, open source is not perfect, but it is still far better in many cases, but especially in the case of GrapheneOS. It is a probability game in the end and I'll take my chances with open source any day of the week, if the project is somewhat big and additionally even focuses on privacy and security.
You might say: Then take the open source version of GrapheneOS. While yes, that is a possibility, the more import issue here is trust. Because trust is maybe the biggest factor in that probability game I was talking about. And can I trust people that started shipping closed source patches?
I don't know.
The story how it came to shipping closed source patches makes sense of course, that bad guy Google made a bad decision AGAIN and you just don't have a choice, you just want to protect your users, you are basically the hero in that story, right?
But you do have a choice. You could have waited for 3 months for the information to become public and in the meantime fight for Google changing their decision, although with maybe not much luck here. Maybe something else would have come up. So the story here also sounds a little like the old tale of the security complex: "Yes, we do something not that good (shipping closed source in this case), but we do it to protect the kids/you from terrorists (in this case protect the GrapheneOS users).
So I guess, although I very much like the security of GrapheneOS, if it would have been my decision I would have probably stayed with open source only.
And if in 3 months Google will say: Oh, you know what, why not make the embargo a whole year or maybe even two. Then what? Will you make the case that people could still reverse engineer it faster then the one or two years?