Yep.

But in the Real World, what's the pragmatic difference between Graphene and a well-managed Lineage or DivestOS device, since security and privacy are both managed via layers?

I'm genuinely not being snarky. I tried running Graphene and had issues, and their support was atrociously condescending and critical, so now I'm running DivestOS instead. I've run Lineage on other devices without Google.