They pointed out privacy issues and you're still claiming that GrapheneOS is security first? Location leaks are a privacy issue, for example.
GrapheneOS doesn't have such a narrow focus. As we keep saying, GrapheneOS prioritizes privacy, security, and Android app compatibility. Given those three things:
Privacy: microG's leaks and failure to implement other checks and there's arguably no real gain in privacy since the Sandboxed Google Play approach means Google Play Services and Store don't have privileged permissions.
Security: microG needs privileged permissions to work properly and can also download Google binaries and runs them in that privileged context, depending on settings
App compatibility: It's an incomplete reimplementation. Even microG's GitHub says as much.
Why would GrapheneOS take so many steps back just because the only real compelling argument in favor of microG is "Google bad"?
"Google bad" is THE compelling argument to flash a custom ROM. Many projects like CalyxOS go privacy first, security second.
I am not worried about a random third worlder hacking my phone. This would only be possible if I allow it by user mistake. I am however worried about Google and its business model. As are many others.
MicroG is great because it limits Google's tracking as much as possible. It's lication services can be routed to a more trustworthy party, and you can actually select which APIs microG forwards to Google. Sandboxed Play Services don't allow any of this, and it's bloated and battery hungry in comparison.
Case closed.
CalyxOS doesn't preserve the standard privacy of the Android Open Source Project. It certainly doesn't greatly improve it as GrapheneOS does. CalyxOS consistently goes many months without shipping standard Android privacy and security patches. It doesn't provide highly important improvements to privacy such as Contact Scopes, Storage Scopes, secure paste, fixes for Android's VPN leaks and many other privacy patches/protections provided by GrapheneOS. Lagging far behind on standard privacy patches and protections is a major issue and it's even more of an issue when the very poor security is considered. Privacy depends on security, not only privacy patches, privacy protections and which services are used.
Unlike GrapheneOS, CalyxOS comes with a bunch of connections to Google services and privileged integration of those services into the OS. It automatically grants highly privileged access and data to multiple Google apps when installed including Android Auto. It also has a bunch of other problematic third party connections. GrapheneOS avoids bundling third party apps and services not meeting our privacy standards.
microG and sandboxed Google Play don't compare the way you claim when it comes to privacy or battery life at all. GrapheneOS also does replace Google Play APIs including the location API with our location rerouting feature. Unlike the microG implementation, it avoids introducing major privacy issues including microG having a history of leaking location data to apps which aren't granted access to it.
GrapheneOS also doesn't come with sandboxed Google Play included and works very well without it. We implement network location, geocoding and other features without tying those to compatibility with Google APIs. We'll also continue to expand compatibility with apps depending on Google APIs without sandboxed Google Play as part of improving the sandboxed Google Play compatibility layer. It isn't only for running Google apps as regular sandboxed apps. It's also for replacing parts of the Google APIs for apps using the Google Play libraries.