It has many default enabled highly privileged Google services including downloading Google Play executables such as droidguard and running those with similar privileged access as they have on a Google Mobile Services OS anyway.

It doesn't matter what your marketing says, what's important is what your devices do, and /e/ is much less secure or private than iOS.

Attacking GrapheneOS which makes real progress at privsec.

Thinking that badness enumeration is effective for improving privacy while ignoring real solutions like improving the app sandbox and adding more permissions.

Adding Google services and giving them extra privileges. GrapheneOS ships with zero Google services by default.

https://xcancel.com/GrapheneOS/status/2040887784253141142#m

Fairphone quickly stops providing Linux kernel updates and has months of delay for Android userspace backports along with driver/firmware backports. The delay for yearly updates typically starts at a year and gets longer as devices get older and they've always skipped the quarterly updates.

Using a modern SoC, properly configuring it, using proper signing keys (Fairphone has repeatedly used publicly available sample private keys) and providing proper updates is most of what's needed to meet the requirements. That's entirely doable by the few OEMs designing their devices in-house such as Motorola Mobility. Samsung and Google along with many of the ODMs making devices for Nothing, Fairphone, etc.

https://discuss.grapheneos.org/d/24134-devices-lacking-stand...