GrapheneOS scores well and rightly so, but my main gripe is that they don't ship F-Droid and they actively steer users to Google Play and Aurora instead.
It's weird because the only AOSP app store that has any hope in hell of providing meaningful security and privacy to users is F-Droid, through its FOSS-only stance.
That's not to say that GOS shouldn't exclusively provide and steer users to F-Droid. There are good, practical reasons for providing compatibility to allow users to consume Google Play Services on apps that they need. I get it. I just happen to think most users in the know would want to escape that ecosystem.