Perhaps GrapheneOS should just be an ASOP release with implicit security features that makes it hard to notice it is anything different. If people think it is a vanilla Android install, it would give them no reason to imply criminal activity.
They'd also have to update all their phone spec sheets -- not having the sandbox doubled graphene's battery life on my Pixel 6 Pro (in practice and vs. advertised specs).