Basically GrapheneOS is for people worried about law enforcement or some state actors trying to access their phone using some commercial tools or 0 day exploits. It’s useful for journalist, lawyers, activists and so on.

Average users don’t really have to worry about those things. It’s unlikely that someone will try to hack you using such tools, you most probably don’t have any data wort protecting and it’s quicker and easier for you to just unlock your phone than to spend days/weeks/months in jail trying to protect your data.

What average user should care about is removing Google from their phones and blocking trackers. Other ROMs like iode also come without Google and have better tools than GrapheneOS for blocking trackers. They are as secure as any other Android phone.