Android makes yearly releases. It is developed in cathedral-style. Google releases the source as a single big update. GrapheneOS is a fork. They need to port their customizations and extra software on top of the new release.

Every six months, not yearly. Google releases the major version and QPR2 as part of AOSP. QPR1 and QPR3 are Pixel-only.

Since they switched to QPRs and Pixel drops, major releases have become less important because feature roll out throughout the year. It's just that nobody outside GrapheneOS and Samsung (to my knowledge) rolls out QPR2, so for non-Pixel/Samsung, the major releases are... major.

I think another major source of work for GrapheneOS is when Google releases QPR1 and QPR3, because GrapheneOS had to rebase the driver/firmware changes on top of QPR0/QPR2.