Also, scrambler is not mandatory (I don’t have it enabled) so Graphene OS devs explanation that “we will not enable patter ulock because it’s not secure” while normal PIN can be enabled still doesn’t hold.

Also, who are “they”? Yes, someone in some situation can figure out the patter from smudges. In other situations someone can see your PIN. If Grapehene dev are so worried about screen unlock security they should implement the system BlackBerry had which was super convenient and impossible to figure out even when looking directly at someone’s screen.