[Dismas]

if a person values security and privacy, they should not use any mainstream products.

Roughly the same as security through obscurity, which doesn't work. Not to say custom ROMs don't have benefits, but I'd never choose a solution based solely on whether it's "mainstream". Longstanding support and support for Google services are why many will stick with a stock ROM. GrapheneOS is specific to Pixel devices and it's a small team, so there's no guarantee you'll receive support in 5 years.