Grapheneos is the least shady OS. Why would a mass surveillance agency compromise hardware when they can simply spy at the software level though Google's deep insights into devices?

Those Android distributions you refer to are not up to date, don't fully remove Google services, don't ship patches fast, don't improve exploit protections, have worse compatibility, don't make Google's services more private by running them in a sandbox, dont add additional important permissions.

Grapheneos ships security updates faster then Google on pixels. If you want the best protection against zero days or mass surveillance, grapheneos is the best option.

Grapheneos is fully run on donations and has provided information in various posts. Most crypto donations by volume are in Monero, Eth and Bitcoin have a few large donations. They are registered as a legal entity in Canada.

What do you think are the non-shady android distros?