Calyx is pretty insecure by default, it removes some default AOSP security features and is very slow to push security patches. And it doesn’t include any of the GrapheneOS security features like hardened SELinux, a hardened kernel, secure app spawning, hardened Chromium browser and WebView or hardware-based integrity attestation. It also uses a very flawed Google Play services implementation (microG) which requires root and has worse app compatibility.
Using a device with no vendor-provided firmware security patches doesn’t seem like a good idea to me. Also, the Pixel 8a gets 7 years of updates. That’s plenty of time, and most people get a new phone after a much shorter time.
I haven’t tried OxygenOS, but I used Oppo’s ColorOS (which is basically the same thing; there are only a few minor differences, since OnePlus is a subsidiary of Oppo) and it was terrible. The entire OS felt like a buggy mess, and the battery life was terrible because of all the garbage running in the background. I spent an entire weekend removing all the bloatware, but the experience still sucked. That was 2 years ago, after my iPhone XS broke, and I just needed a new phone quickly. My carrier had a deal at the time, where I got the Oppo phone almost for free (very small direct payment, no monthly payments), so I took it. After about a month, I just couldn’t stand it anymore and returned the phone. Then I bought a Google Pixel 6 Pro, flashed GrapheneOS on it, and it’s been great ever since. I’m never using a Chinese phone again. A friend showed me his Xiaomi phone and said that it’s basically unusable with the stock ROM. Phone manufacturers should really stop messing with the goddamn OS, they always manage to turn it into a giant pile of shit. I’ll definitely stick with (preferably degoogled) operating systems that are as close to AOSP as possible, like GrapheneOS.