u84468575 No way to screw that due to anti-rollback
When you sideload it's important to make sure you sideload the correct image. Instructions to do so are given on the GrapheneOS website, but if you're unsure, you can visit the Matrix chatroom to ask for support there.
u84468575 What about the other questions, are the assumptions correct?
It's correct that leaving OEM unlocking enabled will reduce your security. I'm not sure about the specifics, but I know that the developmemt team strongly recommended that you disable OEM unlocking. It's one of the post-installation steps in the install guide.