Off the top of my head:
Lots of banking apps don't work.
RCS has only just started working.
No "Find My Device" support.
Permissions model is difficult to understand - even I struggle with it.
Standard launcher has tiny icons which can't be adjusted.
Pop on to https://discuss.grapheneos.org/ and see the struggles which users have.
I am not ordering anything. I was merely explaining that "Find My Phone" is not a feature -- it is an anti-feature that enables surveillance by a third party. The lack of such an anti-feature should be viewed as an advantage of Graphene, rather than a disadvantage.
Most banking apps work on GrapheneOS. Around 10% ban using any alternate OS, but a small subset of those specifically permit GrapheneOS now in addition to Google certified devices with the stock OS.
It's nearly the same permission model as Android 16 beyond having Storage Scopes and Contact Scopes as easy to use alternatives with fine-grained control along with Sensors and Network toggles. It's otherwise the same.
If you're talking about the exploit protection features with toggles, that's not part of the permission model and the defaults don't break any apps without serious bugs. Apps with memory corruption bugs can be broken by the defaults, which only requires turning on the compatibility toggle for the app. People don't need to understand the finer grained settings.
The default 4x5 icon grid has the same icon sizes as the stock Pixel OS, which can't be adjusted there either.
The vast majority of issues people have with GrapheneOS are issues with Android and Android apps which are not specific to GrapheneOS.
What is the issue with the permission model. It's basically the AOSP permission model. The changes made by GrapheneOS is the user-facing toggle for the INTERNET permission, and the sensors permission.
If people do not want to interface with those features, they can simply skip them, and the permission model will be the exact same as it is on Android.
> No "Find My Device" support.
"Find My Device" means the location of your device is constantly sent to and stored on someone else's computer (the "cloud"), and it is something that shouldn't exist unless that someone else's computer happens to be yours.