GrapheneOS maintains their stock apps so this doesn't apply to them

AOSP maintain their apps in regards to security issues or bugs.

Even Messages, which they say isn't actively supported and may be removed:

https://android.googlesource.com/platform/packages/apps/Messaging/+log

The features, however, are lacking - they mainly serve as reference implementations with just the core features. This is a big reason why GrapheneOS maintains forks or replaces the apps entirely (like the Camera). It would be best to replace more in the future.