I use Mull and Vanadium on Graphene OS, and the experience on Vanadium is just okay by comparison. It is true that not having extensions does decrease the attack surface, and Vanadium does have a built in ad blocker, but it simply isn't as all encompassing as ublock's list.

I use Mull mainly but don't log into anything with it, and have noscript extension on by default.

I also turn off JS by default in Vanadium. Both browsers have ways of making exceptions for certain sites in this case, but NoScript has more granular control.

I remember reading on reddit a convo that basically the GrapheneOS team was much more concerned with security than privacy. This isn't to say they don't care about privacy at all, just that they will always prioritize security first.

This makes sense considering their decision to only officially support the Pixel line of devices. You still are supporting Google by giving them your money (and a bit of your data in the process of purchase). Additionally, the decision to default to using the Google Play Store and sandbox the apps, rather than use the Aurora Store, also points to these underlying values.