GrapheneOS is nice but you also need to educate them on what they would be giving up if they use a custom Os.

First and foremost, whether you like them or not, it only runs on one brand of device.

Any past, present or future proprietary features will no longer work.The time is better spent on hardening the Os rather than reverse engineer features not everyone uses anyway.

A lovely warning message on boot up that could put some people off.