I have Pixel 6 with Graphene and Pixel 5 with stock OS. Also, I have an old ZTE Nubia, which still works. None of them was rooted.

Nubia was hacked remotely. It received no updates for years, so it was an easy target. I unlocked Nubia and plan to install LineAge OS to it when my Pixel 5 will die.

Pixel 5 was hacked from close distance via WiFi or BT.

Pixel 6 with Graphene is not hacked yet.

Lack of root doesn't protect me.

However, I use SafeDot to monitor phone access to microphone, camera, GPS, so I'm alerted when it starts to beep, which creates problems for spies, so SafeDot is banned by Google at request of СІА. I cannot fix this, because Google controls my phone instead of me. SafeDot still works on Pixel6 GrapheneOS with warning notification about it «unsafety» though.