See https://discuss.grapheneos.org/d/24134-devices-lacking-standard-privacysecurity-patches-and-protections-arent-private including the linked third party sources from Divested Computing, Mike Kuketz and others.
/e/ and Fairphone have atrocious security. They provide far weak protection against commercial exploit tools than iPhones. It entirely fits with what the French government wants. They either want devices to have poor security where they can break into them very easily or to provide backdoors in the encryption and for remote/physical device access.
