I personally think the booloader lock is of dubious value. It protects against physical attacks against the device (evil maid attacks).
That's very low in the list of threats I worry about.
(Though I am using GrapheneOS, and am happy with it.)
I'd be more worried about the lag between Android security patches (and vendor blobs, which GrapheneOS gets direct with android updates, from what I can tell) and custom ROM updates.
You're much more likely to get hit by some Samsung zero day that impacts 100M active devices than something targeting a custom ROM.
(All of this is assuming you're a boring target, which most people are.)
Anyway, the main deciding factor for me between the two operating systems was device support.
I have no experience with GrapheneOS, but I've heard good stories so far. It's very good to hear that the Pixel devices allow re-locking of the bootloader.
Personally, I consider exploits in the Android framework itself and drive-by-exploits (like BlueFrag) to be the most important security vulnerabilities so I'm fine with LineageOS.
Not everyone might agree, though, and custom ROMs come with some security challenges or problems that stock software does not. I don't think such flaws should be left out of discussions like these.
As for the Android stack itself, LineageOS follow the upstream Android branches very closely where it can. Most vulnerabilities in that stack will probably be shared among devices, so security issues will probably be fixed within a reasonable amount of time. Google's Android patches should also be present in the nearest weekly updates after public release.
The lack of official driver and kernel patches make the security of LineageOS a little strange. There are definitely some patches that LineageOS can apply, but in the end they rely on the vendor to publish all the necessary patches, and that can take a while.
There's also the fact to consider that out of necessity, the bootloader on the phones is unlocked. Most phones won't allow you to lock it again with your own keys (if you try, you'll often brick the device!) so it's trivial for a malicious actor to flash a new OS full of spyware and key loggers onto the system partition.
Having said that, LineageOS supplies weekly updates to my Oneplus One, even though it's showing its age. Neither Qualcom nor Oneplus will ever release any more patches for this device, so for kernel level security I'm boned. However, I still get the latest and greatest Android 11 framework security patches. This should protect the phone against the huge Bluetooth exploit found a few years back despite it being over eight years old now.
LineageOS is quite transparent about this, even showing that their device is missing patches right inside the settings (https://www.xda-developers.com/lineageos-trust-centralized-i...). I don't think you can expect much more from a project run by volunteers.
My daily driver phone receives "quarterly" security updates (sometimes off by a month or so) so I'd rate LineageOS above Xiaomi in this sense. The LOS Android stack itself should also be on par with or even better than some flagship phones.
Sadly, for the complete picture, Qualcom and other manufacturers determine how secure LineageOS can be. In general, the bootloader lock status and lacking supply of source code are a real pain for open source efforts. Some phones may see a mainline kernel with all of the recent Linux patches as a result of the postmarketOS efforts (https://wiki.postmarketos.org/wiki/The_Mainline_Kernel) but cleaning up vendor code and reverse engineering drivers isn't exactly a fast process.