Archive.org has it all saved

Signal

Just ban Tesla, X and everything else owned by Elon Musk

taken from multiple versions of android

They're the newest releases of Google's own AOSP apps. If you don't like the apps and the fact that they aren't maintained anymore, complain to Google. They are the ones who fail to provide up-to-date apps in AOSP, because they want to promote they proprietary, spyware-infested garbage. It's not like you have to use them, you can easily disable all the pre-installed apps, and either replace them with the proprietary Google apps (and disable network access to maintain privacy), or get open source alternatives, for example from Fossify.

There’s no preinstalled apps store

There is a pre-installed app store, which lets you install Graphene's own apps, Google Play Store and services, as well as the Accrescent app store. For everything else, you can grab an APK from the web. My recommendation is to use Obtainium, it easily lets you download, install and update APKs from various sources on the web. There's also an extensive list with presets for apps to download via Obtainium: https://apps.obtainium.imranr.dev/

The security is remarkable but I feel they could give other areas more care.

They don't want to include any unnecessary bloat, so they leave the OS very minimalistic on purpose. You can install whatever you like, and you don't have to deal with removing bloat you don't need.

No contactless payment is really tough too

Some banks offer their own NFC payment system that doesn't require Google Pay and just uses the bank's app. Again, complain to your bank if they only offer mobile payments via Google Pay.

I recommend getting a 6a or 7a instead, maybe even the 8a if you're ready to pay the higher price. But at least get the 6a, it's cheaper than the normal Pixel 6, and gets updates for 10 more months than the Pixel 6. The Pixel 6 has less than 2 years of life time left, I don't think it's a good option nowadays. You can always check on this site: https://pixel-pricing.netlify.app/ (it's in German, but you can either use the website translation in Firefox or on Google Translate)

I hope the companion app will be open source, or the watch will be compatible with Gadgetbridge

Common GrapheneOS W:

Here's the COPR repo: https://copr.fedorainfracloud.org/coprs/secureblue/trivalent/

Use Ungoogled Chromium instead

Secureblue's Trivalent browser looks promising. Currently the only way to install it outside of secureblue is COPR on Fedora, but I'm sure there will soon be packages in the AUR, Gentoo, Nix, etc.

Other good options are Cromite, Thorium and Ungoogled Chromium

Oh that sucks. I haven't used it personally in quite a while, since I switched to the Grafana stack

No, it's not a special "FOSS" version, it's just the official binary distributed through the Guardian Project repo (as I have proven: https://lemmy.dbzer0.com/comment/16230276). If you want a FOSS variant, check out Signal-FOSS or Molly, they also offer a FOSS variant. You can either download it from their custom F-Droid repo, pull the APK from GitHub using Obtainium or get it from Accrescent.