Only "security hole" we have is that my wife switched back to stock Android after she couldn't text with her mommy-groups (which require RCS, which doesn't work with GrapheneOS). Back when it sounds like this was recorded, her photos were syncing with Google Photos (now they sync with self-hosted Immich only). We're not a 'social media' family -- no videos or photos on FB or Instacrap or whatever. I'm completely flummoxed.