[imgr8ness]

if a person values security and privacy, they should not use any mainstream products.

Roughly the same as security through obscurity, which doesn't work. Not to say custom ROMs don't have benefits, but I'd never choose a solution based solely on whether it's "mainstream". Longstanding support and support for Google services are why many will stick with a stock ROM. GrapheneOS is specific to Pixel devices and it's a small team, so there's no guarantee you'll receive support in 5 years.

"...why many will stick with a stock ROM."

I assume my audience here are not people which would be regarded as part of the 'many' when it comes to technical discussions, therefore what the 'many' would do is of no interest to me.

"GrapheneOS is specific to Pixel devices and it's a small team, so there's no guarantee you'll receive support in 5 years."

Of course, but this is based on the assumption that someone using GraphenOS or any other alternative would never consider another option and therefore be at a disadvantage when that choice falls behind in updates. However, any person who is involved deeply in field of computing will know that you never stay put, technology is always changing and a good technologist will always be looking to expand their knowledge and grow.
Computing is not a stagnant field, if you do not keep up with the many changes then your knowledge quickly becomes outdated.
Which brings me to my point, whether a particular OS loses support in 5 years time is completely irrelevant, as any real techie would of probably tried 5 different types of alternatives by that point.