AtmosphericIgnition By that definition, Vanadium shouldn't be in the App Store, since it can be used to download arbitrary APKs.
I think that by default Vanadium is installed without "Install apps from unknown sources" access. Sure, people can turn that on, but they can also turn it off again after installing a particular APK (and I do). Shipping a security-enhanced browser is an important part of shipping an Android variant, so I don't think suggesting that GrapheneOS stop shipping a browser will get very far.
Shipping Obtanium (or providing an endorsed path) would be useful to people who will use Obtanium carefully, but -- clearly -- it is not necessary for those people. And shipping Obtanium (or providing an endorsed path) seems likely to encourage users who are not careful to start using it.
AtmosphericIgnition If they were to just use Vanadium to do this, the process would be exactly the same, except now the app installed this way won't be automatically updated?
Some updates are beneficial, some are detrimental, and some are malware.
Staying on top of security updates from a team with good security practices is generally prudent. Beyond that, whether installing every update is good depends on the user and the app.
Some people who like F-Droid are surprised that GrapheneOS doesn't ship F-Droid. Some people who like Obtanium are surprised that GrapheneOS doesn't ship Obtanium. Overall, the team seems to be very cautious about what they ship or endorse.