I think evil maid attacks are a realistic problem for anyone regularly travelling through airports. I think there are quite a few people who would like to know when someone tampered with their phone. Certain shady governments are known for demanding you hand over your phone if you look suspicious/foreign enough.

I have no experience with GrapheneOS, but I've heard good stories so far. It's very good to hear that the Pixel devices allow re-locking of the bootloader.

Personally, I consider exploits in the Android framework itself and drive-by-exploits (like BlueFrag) to be the most important security vulnerabilities so I'm fine with LineageOS.

Not everyone might agree, though, and custom ROMs come with some security challenges or problems that stock software does not. I don't think such flaws should be left out of discussions like these.