Don't? He has mentioned in multiple interviews that security hardening is only for pedophiles and spies (sort of implicating GrapheneOS). They are inaccurate about /e/OS being degoogled. They install F-Droid packages through a proxy (CleanAPK.org) that they do not want to reveal the purpose or owner of, which combined with the Android Trust On First Use (TOFU) model is a big red flag. And then we haven't talked about all the kernel trees, firmware trees, and Android releases that are way behind and have hundreds of known vulnerabilities.

Either they are very incompetent or just fishy.