https://docs.qualcomm.com/securitybulletin/october-2026-bull...
Then, they only roll out ASBs, which fixes vulnerabilities that have been known for up for six months, because they don't roll out embargoed patches like e.g. GrapheneOS does (and these vulnerabilities have been known for months through reverse engineering).
If that wasn't bad enough, ASBs only fix vulnerabilities high/critical, for all other fixes you need QPRs and major releases, but /e/OS is behind major releases. If you are still running Android 16, your phone has vulnerabilities that are known for up to two years. Yes, they are low/medium, but they are used in exploit chains. This recently got worse, because Google recently started only rolling out some high/critical fixes to Android 17 and not older Android versions.
Then there is all the shady stuff that Murena doesn't tell you about, like running Google's proprietary DroidGuard blobs in a privileged process on Play Integrity requests. Giving certain Google apps higher privileges than the normal Android app sandbox. Installing F-Droid packages through a proxy (CleanAPK), that they do not want to reveal the owner or purpose of, etc.
Why don't the GrapheneOS developers like Murena? Because Murena often instigates in interviews that GrapheneOS is for criminals, etc.
If you care about security (or privacy) at all, don't use /e/OS.
Disclaimer: I am not affiliated with the GrapheneOS project in any way. If you don't like GrapheneOS but care about having some basic security, then get an iPhone.