Can somebody with more experience than me weigh in on that comparison?
tl;dr: the chart is generally accurate, but skewed. If security is the one-and-only concern, it’s a great resource, and pretty accurate. If there are other areas of concern, the chart fails to account for some of them.
So, like Coke vs. Pepsi, Mac vs. PC, KDE vs. GNOME, there will always be fans of one system vs. another, and arguments will continue for as long as options exist. That’s just boilerplate.
In terms of what’s written there…my opinion is that the different options serve different needs and thresholds of privacy requirements…also, ‘privacy’ implies a ‘from whom’ that varies; I’m fine with my wife knowing things that I’m not fine with my employer knowing, and I’m fine with my employer knowing things that I’m not fine with Google knowing.
Put this together, and you’ve got a good amount of explanations about the chart. Of course, Graphene looks pretty good on that chart, and credit where it’s due - you’re hard pressed to find a mobile OS that’s more militant about - or effective at - keeping data on the device. However, the criteria itself seems just a little bit slanted, in my opinion. Take for example “Webview update speed”, or “Can disable USB-C and pogo pins data?”, or “Closed cross-profile package leaks?”, each of which Graphene provides, and the others do not. It’s certainly fair that these functions may matter to some people, and most people would prefer having them than not.
The massive counterpoint here is that the chart either glosses over, or omits entirely, the things that make /e/OS stand out, that Graphene does not come close to addressing. There are a few nods to app compatibility, but nothing firm. This is probably a good thing because Revolut - and lots of other banking apps - will not run on Graphene, while Murena has put time and effort into resolving those issues. WhatsApp can work on Graphene with some effort, but it works on /e/OS out of the box. In fact, I’ve run into more issues with apps barking because I run a rooted phone, than apps barking because I’m running /e/OS. The same isn’t true for Graphene. The chart conveniently sidesteps where apps even come from; one has to manually add the Aurora Store or F-Droid (or ‘adb sideload’, for all the fun that is)…but /e/OS ships with the App Lounge, that has OSS apps and PWAs and Play Store Apps, and can handle app updates, all in a UI that’s as easy to use as the Play Store or App Store. Graphene doesn’t offer anything like this at all.
Similarly, Murena gives options for cloud/PIM services. One can sidestep it entirely, or use Murena’s cloud that has entry-level account options for free and inexpensive paid options, or the Murena team provides install options for one’s own server, or one can use their Google e-mail account, or one can put together their own hodgepodge of NextCloud / IMAP mail / CalDAV / CardDAV, and that too is a common-enough use case. With Graphene…there’s no real solution for this. One can put a Seedvault backup somewhere, and that’s great…but if the chart creator put a dozen rows for all the things available on a Murena account, even Google would look favorable to Graphene on a head-to-head comparison.
Finally, the chart tacitly admits another shortcoming of Graphene, namely that it’s only available on Pixel devices; sixteen of them to be exact - the least of any of the ROMs compared. Calyx supports about 30 devices officially, and another 30ish unofficially. iodeOS supports about 50 devices officially, with another 50 or so supported by the community. /e/OS supports over 200 devices officially, with Ronnie and others building ROMs to cover hundreds more. LineageOS is far more difficult to count based on both volume and live cycle; if one were to count the number of devices that ever received a Lineage port, even if the device is EOL, the number would likely be in the thousands. While there is wisdom from a development standpoint in limiting the supported device list, and to be fair, Pixel phones are pretty easy to come by both in retail and on the used market, this decision does severely limit the number of potential users in a way that a broader compatibility list does not.
In summary, it is my assessment that /e/OS is a middle ground between the two extremes of Google-laden stock ROMs (no privacy at all) and GrapheneOS (Extreme privacy at the expense of usability in a number of areas). The chart does a poor job highlighting this balance, since its focus is on the security functions. That’s fine, but if someone were to make another chart that replaced relatively-obscure security functions like “Hardware memory tagging?”, with “Quantity of Top-100 Play Store Apps which require additional steps to load reliably”, or “Quantity of known banking apps with compatibility issues”, or “photo syncing”, the chart starts to look just a little bit different, with the first party stock ROMs ranking far higher in those categories.
This isn’t to disparage Graphene or the chart. Both are solid projects, and there is a market for an OS that focuses on security above all else. Not everyone can just buy a Boeing Black, but Graphene is probably what I’d consider to be the closest to it. If that’s the desire, I don’t know that I’d recommend /e/OS or iode or Calyx because there are some tradeoffs that a security-above-all-else like Graphene foregoes. However, I am of the persuasion that /e/OS and iode and Calyx all remove or effectively mitigate somewhere between 90 and 98% of the Google/Data Broker snooping by default, in a way that retains compatibility for places where I make a conscious choice to utilize a service that can compromise my security in some way.
because there will be no large user base to entice developers to develop apps compatible with the platform