Great work. They haven't commented on this matter for some time now and its good to see an updated comment on this issue.
I use Grapheme OS, but do use Mull. I also use Vanadium and base Chromium. Each for different uses. Mull for general browsing (I have many extensions, but I feel a bit more secure by running NoScript).
Vanadium is for when I need more functionality, and raw Chromium for inspecting responsive design of my own sites.
The GrapheneOS community is a great asset to the Android ecosystem, and their mentality has always seemed to be security above all else (even above privacy), which is a voice that is needed in any organization.
Again, thanks for doing this investigation.
Is it a light read?