Don't forget proprietary security patches are only open sourced 3 months after -- GOS has them due to their partnership with Motorola.
A sufficiently motivated threat actor will have them (the exploits) too.
It's optional.
Unless you are using the most expensive flagship of a few Android brands, you are also vulnerable anyways
GrapheneOS doesn't receive early access to security patches via Motorola. We receive those through a different partner. We were already doing security preview releases prior to Motorola giving us access to their repositories which don't contain those.