What the specific difference is, is that on grapheneos I can control the sandboxing myself with storage scopes and contact scopes. On iOS in terms of security the sandboxing is good but the user is treated like a child who shall not be able to customize because they could mess it up. Same exact thing with the installation of apps from unknown sources.