someone1223 although it is very dangerous to not have fully up to date OS
This is incorrect.
The risk to a user of not installing particular updates depends on their phone usage.
Some users do not use cellular functions or even have a SIM installed. Why would vulnerabilities in cell functions be a concern to them and a need to immediately update?
Other users click on all kinds of links on unknown sites, without the protection that using Firefox and uBlockOrigin and a DNS which blocks malware sites provide. Others do not.
Some users take great care in choosing trustworthy software apps to install and keeping it updated. Others do not. Some users install hundreds of apps. Other users do not. Apps and browsers are almost always the vector for exploits, so user risk varies greatly.
I wouldn't image much risk at all to any GrapheneOS who does not connect their phone to the internet but never update, unless physical access to their phone by others seeking to spy on or harm them is a big risk.
Users are free to create different risks or not by their own use and the stated objective of the project, and have different threat models.
There is also a risk of installing updates, especially as GrapheneOS does not provide a "security updates only" update channel, but instead includes new features which may, and sometimes do, introduce new, exploitable vulnerabilites at the same time.
Blanket statements that out-of-date software is "very dangerous" are simply wrong.