chmed What I'm having a hard time coming to terms with is the idea that any handset past 3 or 4 years, regardless of whether it works or not, is only fit for the trash.
Me, too! For example, in theory I might be typing this message on a 12-year-old laptop. But since I carry my phone (meaning "tracking device") around all day, and they're easy to steal (or be lost), I really would like my phone to be pretty secure. And I also want a phone that doesn't share everything about me with Google/Apple by design. At present that sort of works out to be GrapheneOS, and GrapheneOS can't at present provide good security guarantees once devices age out of Google firmware support.
chmed It seems to me that if I can install something that keeps it from "calling out" of my local network and keeps apps sandboxed, then I can keep almost any phone useful doing something, although it may have to never leave the house.
In the limit, if you have an old Android phone and use it as an alarm clock, with Wi-Fi off and no SIM card and in airplane mode, that's probably not a big threat. Or if you set up a separate Wi-Fi (and wired) network for the "IoT" devices in your house, and none of them can do anything with real-world effects (such as controlling your furnace), that might be ok too.
chmed My question, ultimately, is whether Graphene for Pixel [1] actually has more security features than stock. Or to flip it, are there any security/privacy features that Graphene is missing compared to stock?
You might want to look into other options, e.g., DivestOS. I think both the final GrapheneOS for the Pixel 1 and the final Google OS for the Pixel 1 might be pretty stale by now. For some threat models, DivestOS or LineageOS, etc., might be safer.
Overall, once a device falls out of GrapheneOS support it is probably prudent to stop using it for the GrapheneOS target model, i.e., things you want to be secure and private. If you're not going to use it for genuinely sensitive purposes, it's not clear that an expired GrapheneOS is the best software platform.
The good news is that the industry appears to be moving toward longer device support. So there is room to hope that the current mass of three-year devices (e.g., the Pixel 3a I sadly retired) is a one-time "glitch" rather than an ongoing syndrome. If a device is supported for seven years, by that time a lot of them will have some sort of hardware problem -- battery worn out, screen wearing out, digitizer wearing out, radio range shrinking, etc. We'll see, I guess!
Please note that I don't speak for the GrapheneOS project.