Google made changes to the AOSP release cycle last year. This change took AOSP from an open source project where every commit was visible, to more of a source available "here is a tar ball with squished commits so you can't say we violated the license" once every 6 months sort of deal.

Due to those changes, AOSP forks are faced with 2 options. Stay fully FOSS, reverse engineer each tarball drop for figuring out what each new commit was for and adapting that into your codebase, or the Graphene approach of partnering with an OEM (Motorola) to gain access to embargoed AOSP code, and maintaining 2 codebases (Graphene FOSS, and the Graphene embargoed version).

Graphene is trying to maintain their security goals even if it means the end user can not completely compile the most secure version of their OS on their hardware.

Lineage, Calyx, and Lineage forks l4mg, /e/OS and iodeOS are (whether by choice or by the fact collaborating with an OEM is a difficult pain in the ass) taking the first route.

You can use GrapheneOS's open source update channel, but you miss out on some security updates.

Ive always felt every android fork has its place, just the same way every linux distro does. They all serve a different purpose.