Surely that's better than "nothing", isn't it?
GrapheneOS is more secure, but you're talking privacy here. With GrapheneOS I could run the Play Store or Google Maps in a sandbox, but it would probably not be better than not running them at all, would it?
Then I got my first banking app and was decompiling it on each new version, removing checks for root, "compatibility" and security checks, and compiling it back. Then another app came, this time for public transport, and I was reversing two apps, once every 2-3 months. Became quite efficient with it.
Then I deliberately bought pixel for GrapheneOS, installed it and never looked back.
As I have already mentioned: I am not using Android because I like it or I would want it. Sailfish has everything, I will ever need. For myself.
But not for living in this world.
I am not interested in your complaints, really. I was interested in your take about the privacy issues on other custom ROMs, but it really feels like you don't know. And that's okay.