Google stopped publishing any info about security updates until (I think) quarterlies come out. GrapheneOS had to sign some sort of non-disclosure for them, in order to roll them into updates.

If you don't have that on, then you're not fully up to date with security updates. This could be the difference.