Will Graphene release the patches concurrently with Google? If there's a lag, then then Graphene is a tiny bit less safe in terms of one-day/n-day bugs.
Not having the source of the patch adds some friction to all attackers, but reversing vulnerabilities from binary patches has a long history.
For the security preview channel where they have to withhold the code until it's officially released yes that comes out with/days after Google releases them publicly.
Not having the source of the patch adds some friction to all attackers, but reversing vulnerabilities from binary patches has a long history.