The requirements are indeed minimal. I have no problem with your valuing independence from Google, but please don't misrepresent GrapheneOS' requirements as the highest degree of security because not even they have said that. They have actually mentioned wanting to be more involved in the hardware/firmware side to implement more pro-user changes.
They are mostly basic requirements that Android OEMs should be embarrassed not to meet in 2026.
I don't get your logic. Requirements are a choice. It's very easy to create requirements that exclude every device but one.
Example: "It has to be the Samsung Galaxy S23". Done.
Now you can disagree with those requirements, but that's completely different from saying that the requirements are wrong.
Again, requirements are not laws of physics. As the author of a project, I am free to make up my own requirements, and when something doesn't meet them, then I am free to reject it because it does not meet my requirements...
If you go to a bank and they refuse to lend you money because you don't meet their requirement, you will have a hard time convincing them that their requirement are wrong and that they should instead replace it with yours :-).