When you have a unique goal and set of constraints that are not shared by most users and are actually opposed to the interests of most users and developers it’s not a good idea to try to add them into an existing general purpose project.
Part of the memory tagging support of graphene for example is that the applications need to actually support it too. You can force them to deal with it, but that causes instability and crashes.
Shouldn’t all applications support memory tagging? Well that would be nice but it makes everything slower and only a few schizoid weirdos want it. Clearly the better option is to rewrite the basic system apps that everyone expects to support all the optional security features graphene requires.
Bear in mind graphenes security competition is ios. The system applications in ios all got rewritten to support emte when apple rolled out os level support for it combined with concurrent releases of new hardware with silicon support.
They’re playing a different game than the aosp community.
Another thing to keep in mind is ai is what people are going to be using to try to find vulnerabilities in the software so using it to beat them to the punch is just good development practices.