You are still having to trust a pile of binary blobs even if you built and self signed every release yourself, which I used to do, but at 240gb of source code it is not practical for most individuals even if you do trust all those dozens of blobs from random vendors, which I do not.

This one is not really a fault of GrapheneOS, and more a reality that Android is not actually an open platform and never will be. I require a lot more control of a device I need to be able to trust than anything in the android ecosystem can offer anymore.

Replicant was the right approach but sadly never got the resources to pursue it at the required scale to support new devices.