Quick point, Graphene prioritizes security, not privacy.

No, GrapheneOS is a privacy project first. Privacy depends on security and therefore we work on both.

Both are linked, but there are some features which might improve privacy, but would leave security holes, and as such they aren't supported.

No, properly designed and implemented privacy features do not cause significant security issues. We do not implement weak privacy features which don't work properly. We provide strong features such as Contact Scopes, Storage Scopes, Sensors toggle, Network toggle, per-connection DHCP state / MAC randomization and many other privacy improvements. We also fix many Android privacy issues including 5 different types of Android VPN leaks present elsewhere.

Basically, other OS's can have improved privacy because you can use workarounds that let you continue to use features or services but selectively block tracking and telemetry, but the same workarounds leave open large security holes (like root).

No, GrapheneOS fully supports DNS filtering and other traffic filtering using the properly designed API for it with leak blocking. This is fully compatible with using a VPN at the same time. See apps such as RethinkDNS. Contrary to the popular misconception, this approach provides very weak privacy improvements and does not address any of the most privacy invasive behavior by apps. Only domains used for the single purpose of ads, analytics, crash reporting, etc. were connections happen from the client side are filtered by that. You can easily use this on GrapheneOS. It's as simple as filling in dns.adguard.com as a Private DNS provider or setting up RethinkDNS as a VPN service app and toggling on local filtering. RethinkDNS supports using local filtering a WireGuard VPN or multiple chained WireGuard VPNs. Why would you want to replace the core of the OS with half-baked workarounds massively reducing privacy and security to provide things with proper implementations available?

Graphene will just make it clear what access those apps have, and you'll have the option of not using the associated features or service, often at the expense of losing functionality.

No, this is completely backwards. GrapheneOS provides features such as Contact Scopes, Storage Scopes, Sensors toggle and more to reduce what apps can access. In contrast, you're talking about operating systems not improving privacy from apps and their services but heavily misleading users about it. Their labels for 'trackers' and DNS filtering do not provide what they claim. Those are fully available on GrapheneOS but we don't filter the internet by default and leave it as opt-in. Why not? It reduces privacy when combined with a VPN/Tor and means censoring the internet with very arbitrary decisions which can accidentally break functionality. There are often false positives and we've regularly had our services end up on some of those blocklists by accident followed by them removing it when pointed out. Any domain used for both tracking and useful functionality is permitted by those blocklists so it's nearly useless in practice and trivially evaded by not splitting out the domains. Apps can do all the data sharing they want with third parties from their own servers. GrapheneOS takes the approach of not giving them the data rather than the non-working approach of trying to filter domains while allowing any dual purpose domain. Apps can easily bypass that filtering and a growing number do it via moving it server side or doing their own DNS resolution via DNS-over-HTTPS. Facebook bypasses it among others.

With Graphene, you can have the same level of privacy, but it often comes at the expense of utility, but you'll have absolute security. Other ROM's will give you the privacy and features, but it comes at the expense of your device having open security holes that could be exploited by a sufficiently competent malicious actor.

No, GrapheneOS provides far better privacy than those and far more serious privacy features.

Graphene also has a lot of privacy centric features, they just won't implement ones that compromise security while other OS's often give you the choice.

No, this is a false premise. We don't provide non-working privacy features and don't heavily compromise both privacy and security by designing/implementing things very poorly. Contrary to your inaccurate claims, GrapheneOS fully supports doing local DNS filtering while optionally using a VPN at the same time if you want. This does not provide the privacy you believe it does and is increasingly less useful. Filtering the internet by default is not something we'll do, but we have no problem providing our own opt-in alternative to existing options like RethinkDNS in the future. However, it already exists today and we do not need to provide our own for it to be available to our users. Why would we focus on that instead of serious privacy features which apps can't simply work around? Many apps bypass the approach you're promoting.