Subliminal If you want to attract more users, consider incorporating other features that are not only security focused. Most people could care less about security/privacy features but if we marketed it in a way that would have features that normie users would like, it would get more attention.
The "scarcity" of features in GOS is actually a feature, if not THE feature. As a rule of thumb it is more difficult to reach a higher level of privacy and security the more features, as in apps, your device has. With each feature the attack surface potentially increases.
However, GrapheneOS supports most features a standard user would expect from a smartphone these days, I guess. There's a limited number of apps that do not run on GrapheneOS but then there's this very supportive community that comes up with a solution if there is one.
Also, from a certain point of view, one could consider the relatively low GrapheneOS user counts as a security feature. More users means more data and more potential victims and it becomes more reasonable for adversaries to find ways to attack it. The increased popularity of Unix operating systems in the private sector had a similar effect - when I was a kid Linux was considered safe as there were virtually no viruses, worms, Trojans out in the wild simply because it wasn't worth it to invest time and money to break into those 5 computers that happened to have a Linux OS running.
Mainstream brings financial benefits and to change the public's behavior when it comes to privacy and the security of their data is a noble and important goal. I would love to see how GrapheneOS changes the world, to use a little pathos here, but going mainstream almost always comes with trade-offs as you have a to cater to wider audience. I do not believe that is necessarily a good thing.