Does missing Android 15 QPR2 features make it a security risk? Is there any reason not to use the 9a with GrapheneOS as is? Or are you saying it isn’t possible to use the 9a with GrapheneOS until Android 16 port work is complete?
Discussion
It's mostly just Android features than security related, but still better to be forward.
You can use the 9a with GrapheneOS now, it just doesn't have the QPR2 features. It will skip straight to 16.