This comparison is pretty damning: https://eylenburg.github.io/android_comparison.htm
Calyx is _not_ a hardened OS, and runs on devices with insecure hardware and firmware (like a Fairphone). Additionally, app compatibility suffers because they use microG instead of proper sandboxed Gapps, and also lacks many QoL features that guard against hostile apps (storage scopes, contact scopes, ...).
microG is not a drawback, it's a proper FOSS implementation, which I vastly prefer to running Gapps in a sandbox. App compatibility has been perfect for me.
The main criteria for it to be strictly better is that you do not give root to a dev that hallucinates enemies and then send their goons to attack them. See https://www.youtube.com/watch?v=4To-F6W1NT0. It's nice that Graphene has a hardened kernel, that helps nothing if you can't trust the developer - different attack scenarios.
[1] https://discuss.grapheneos.org/d/12565-is-gos-development-sl...
[2] https://discuss.grapheneos.org/d/21819-impact-of-ongoing-war...
I am always a bit sorry when I have to bring this up, that is why I only mentioned it when prompted. Mental health is a sensitive topic and hammering the problem won't help him, but it is just so relevant when users rely on the security of their system, even pick Graphene because of heightened security needs.