GrapheneOS adds the option to set a 2nd factor PIN for fingerprint unlock to make using a strong passphrase convenient without the downsides of biometric-only unlock.
Pattern lock strongly encouraging using only a tiny subset of the possibilities so it's much worse than your analysis shows. It was removed from GrapheneOS years ago because it's far worse than simply generating and using a random 6 digit PIN despite appearing to be similar. It gives a false sense of security and we didn't want to add support for a duress pattern or random pattern generating alongside those planned features. Built-in random PIN and passphrase generation is still in progress but has been started and will be shipped.
my comment was about the decision of that person who deleted the comment to go for the pattern lock, while/because? 16 chars was supposedly bad for the password (although he/she has a point in that the limitation is annoying and counterproductive)
all of this i reckon was not criticism of GrapheneOS but stock Android, AFAIK grapheneOS's choices are all very sound
Pattern lock isn't exposed to the user afaik because it's insecure.
>I wonder why don't they just allow for longer passwords
They allow up to 128 digit passwords which they changed from AOSP.
I use a long passphrase for primary unlock and it's convenient because you only enter it when you restart.
If you rely on the secure element than 6 digits is fine. A long passphrase ensures you're protected even if the secure element is exploited.
It's theorerically possible to use side channel attacks against the security chip to bypass this, of course, but that requires opening the device and some very precise, damaging operations, assuming the attacker has a known-working side channel attack in the first place.