This comes from the people who run GrapheneOS e.g. https://discuss.grapheneos.org/d/24134-devices-lacking-standard-privacysecurity-patches-and-protections-arent-private. Maybe they're opinionated for some reason that extends beyond the hardware/software.