If you're smart enough to buy a phone that supports GrapheneOS, AND install it, yeah you should have root.
And tools like XPrivacy and plugins allow control of subsystems like GPS spoofing and lying to apps.
Mobile phones store incredibly intimate data and are incredibly vulnerable to seizure. It stores my message history, pictures I've taken, so many other records that together would provide an incredibly detailed view into my private life. And it is on my person at all times, even through checkpoints where I have minimal protections against search and seizure like borders! This is not a device that I want a broad surface for modification of system software on.
Providing a good interface for that access is a specific missing capability. But we shouldn't presuppose that the only way to supply it is a global su. The former is a bounded fix; the latter changes the isolation model of the entire system. A portal is mediated, scoped to what you asked for, and revocable. Root is none of those things.
Seedvault is itself an example. The need for backups can be met either with a narrow backup service or by handing out root and letting you do it however you like. Those two have very different security properties, and you can want the new capability without wanting a generic privilege escalation path to deliver it.
So you're arguing the same technofascist arguments that Apple and Google both claim. I own my phone, not technofascist sky daddy, or whatever developer also envisions that role.
My hardware. My rules. More people like you need to learn what ownership actually bloody means.
The graphene team provides so much value already. I don't expect them to cater to every need 100%. They are a positive force in the ecosystem when every other Android provider is locking down their builds they still provide everything as open source with security updates as best as they can.
I think the decision of GrapheneOS to maintain the attestation features and not providing user root is what gives it a fighting chance of being accepted as legitimate 3rd choice. See: Revolut and others adding GrapheneOS keys and trusting their attestation
Like or not, for most users, having root access is a liability, especially with more and more important things being held on phones . Someone downloading a photo editing app and then having a rootkit installed in the background that waits to empty their bank account is not a workable situation.
Yes, that would be absurd. Thankfully, that isn't how root access has worked in a very very long time if ever. If photo editing app requests root access... you click deny and uninstall it.
You don't even need to patch it, AFAIK. You can just install magisk, which is how you're supposed to get root on LineageOS as well.
Why not root has been explained many times and you actually either want the official image with no root exactly because of the benefits, or you want custom image because you don't need these benefits.
For location faking Mock location works on GOS,l.
I see much bigger problem with not having a reliable backup than not having root.
It's not anti-user if it doesn't add the features you want that would destroy the security of the OS.
It has many features that give the user more control. Like disabling emergency alerts, protecting your data from attackers, contact and storage scopes (lying to apps for more privacy while retaining functionality), sensors permission, network permission.