How is GrapheneOS a bigger risk than a stock Android missing 3y of security updates?
Given that all these banks happily accept the latter, we can conclude that they do not actually perceive any of this as a real risk. Ergo, something else is going on (eg incompetence)
Also, an owner of a grapheneOS phone is not going to perceive it as greater risk, and an owner of a non-grapheneOS phone is not going to give a shit either way whether they support an additional OS.