ve3jlg To say that serious AOSP defects are not a GrapheneOS issue is nonsensical.
If an issue arises in code specific to GrapheneOS, it seems pretty unlikely that Google will submit a fix to the GrapheneOS team. If an issue arises in the AOSP code base, it is plausible, albeit far from certain, that Google will submit a fix to the GrapheneOS team (and everybody else, via AOSP). That seems like a potentially sensical distinction.