I think the reason GrapheneOS never did a GSI is because most of their security improvements rely on specific hardware calls that GSI abstractions don’t provide access to. This probably would still be an improvement over lineage though, just not as secure as base Graphene is.