> Or would you say that the Play Services bring the security model to Google-certified Android, GrapheneOS implements its own security model from scratch, and

> Or would you say that the Play Services bring the security model to Google-certified Android, GrapheneOS implements its own security model from scratch, and LineageOS as well? Yes I would say that most of the security decisions are not baked into AOSP and every rom brings their own decisions.