[hollerith]

>isn't the idea that you use apps compiled from source by distro maintainers

That might work if the main danger was upstream maintainers with bad intentions. But the main danger is security holes that no upstream or distro maintainer knows about, which allow attacks by parties that are not open-source maintainers.

Big picture is that GrapheneOS is much, much more secure than PostmarketOS.