Hi thanks for coming in, we most need official people that could clarify things!
first: Yes you did open source the antivirus but with that being said android itself if you’re not carelessly sideloading nefarious malware (especially ones that force admin privileges) has really good preventative measures in itself to the point you dont exactly need an antivirus, I think your team and even the creators of the FOSS Projects you violated their GPL on would agree. and I already said the second part I wanted to say.
Kernel: Was honestly mandatory but kernel isn’t enough, we need to be able to see the source code of the operating system, many projects even Calyx and Lineage out of all people fully open source their project. You just did what companies like Xiaomi also does already and for a while out of many companies (source).
With that being said, Graphene did rightfully criticize your choice of SoC, going for Qualcomm or something like that could have been a safer choice (I hear Qualcomm with Custom ROMs/Oses aren’t easy to port I think but that’s besides the point) tbh but more importantly if you were to comply with GrapheneOS’s requirements instead of trying to double down or something, Now that you went as far as to make the bootloader unlockable, This in my opinion would have the biggest impact, especially when you can keep that relationship. Now for what people will criticize Calyx for, if they are willing to support your phone assuming you send them one or otherwise. Great, but otherwise still I feel working for compatibility with GrapheneOS that ensures security and privacy would have been unique for sure.
Open source hardware where you can, not mandatory but is a plus.
Please keep in mind I don’t affiliate with any projects, nor PG, nor Techlore, nor Graphene (in fact I have my own greivances not gonna get into, not the independent mods or anyone else.), etc. I just want to be critical where I feel is mandatory in hopes that if you do improve upon it, anyone or everyone can be happy.