The graphene project seems to choose security over freedom in a few cases. They also recommend using the Google Play store over F-droid IIRC.

Not my preference, but they seem so far ahead of other ROMs right now that I use it still.

I do believe people have built and installed it on other devices without too much trouble, but I don't think that'll ever be supported.

The requirements are not particularly stringent. It is more an embarrassing show from the rest of the Android OEMs that they don't meet basic standards like timely security updates and a decent support period.