Due diligence and personal responsibility for what is likely your most important computing device, instead of contracting that out to firms who would stab their grandmother to improve their quarterly numbers.
If Google, with their army of engineers, hasn’t been able to track this bug down, why would I expect a team of volunteers to have done so? They do their own customizations, but it’s still based on AOSP.
To be clear, this is not meant to disparage the GrapheneOS devs, but there’s an obvious difference in available resources, so I don’t really expect them to fix hard-to-find bugs in AOSP.