From a user's perspective, when you install an app, you can:

1. Determine if that app is allowed to access the internet.
2. If it needs access to your contacts, you can share which of your contacts, it can see (or none at all)
3. If it needs access to your files, you can determine which files/photos/music it sees (or none at all, but the application still believes it has access to everything)

There are a bunch of other, security features it provides, but from a "normal user" experience, the ability to take control of your data is probably one of the most impactful.

It is possible to do similar things with other CFW, but AFAIK, graphene is the only one to cleanly integrate it as a polished feature of the ROM.

edit: fix formatting