Not really. Their CEO has said that privacy and keeping data away from big tech is their priority and security, while important, is not the tip of the spear for them.

He phrased it poorly ("we're not developing a phone so a paedophile can evade justice") but people immediately misrepresented it as "The only people who care about security are paedos and crims". Graphene went hard on them with a big FUD campaign that got a lot of people upset. All he meant was that people with very extreme threat models would be better looking elsewhere.

Very much a storm in a teacup.

Yes they have. It's also very late to security updates and is mostly just Lineage plus their own cloud services.