If these two issues are what prompts you to call a “security dumpster fire”, I would say we at least have very different risk perceptions.

We do. I can’t in good conscience recommend it as an alternative to friends or relatives when even stock Android has improved security. I can’t speak for your social circle, but all the people I know update their phones accordingly. Maybe they delay the update for a few days, but they don’t stay months with their phones like that. Fairphones improve the situation a bit since you can lock the bootloader, but the substantial delay in security updates is still a major risk.

I don’t get why anyone would choose /e/OS over Graphene if they had the option. Graphene offers the highest security and privacy, it works wonderful and most banking apps support it. /e/OS just has the advantage of supporting more models, but if you can get a Pixel what’s the point?