Graphene adds many privacy features on top of regular AOSP. But it only works on phones that has good security features that are not woefully outdated or completely closed-off. Google has complete control over Pixel supply chain and they can make their phones with all bells and whistles for their ends and they behave a bit benevolently and expose the interfaces to the user too.
Most Android phones use Qualcomm which doesn't give a flying fuck about giving control or privacy to the users.
AOSP is still the best Linux-based environment for consumer use case from many aspects. It handles hardware better than GNU-based desktops, it is more secure, it supports things like HiDPI screens better and it has a stable API to write applications against and many people and organizations did so (you can still use Android 4 apps).
AOSP has strong Google influence but it is possible to use it without feeding data to Google.