I generally agree with the sentiment about the average consumer, but the commenter above called out MDM specifically, as in, corporate Mobile Device Management (MDM).

I definitely see how large security conscious companies could be quite interested in a good GrapheneOS phone since it would alleviate fears about their corporate data getting leaked to Google, and really allow them to secure the phone in all the ways they want. So the market wouldn't just be niche privacy conscious consumer, but companies buying these phones for employees.