I think this is only the case if you use GrapheneOS with Sandboxed Google Play. Obviously it is more privacy invasive to have a literal Google app on your device constantly running even if it is sandboxed, whereas with CalyxOS MicroG is somewhat of a proxy/anonymous workaround to Google Play. The reason why they say CalyxOS is less secure, is mainly because they have a tendency is fall behind on security updates for up to weeks or even months, whereas the GrapheneOS team is always on top of it. So, the privacy aspect goes like this: GrapheneOS > CalyxOS > GrapheneOS with Sandboxed Google Play. The security goes like this: GrapheneOS > GrapgeneOS with Sandboxed Google Play > CalyxOS.
I shall note that if you are like Richard Stallman and an extreme free software advocate then CalyxOS is the one that will align with your needs more.
Also FYI, the GrapheneOS and CalyxOS teams do not like each other at all, mainly because the old GrapheneOS head, Daniel Micay, was a toxic individual. Check out this video from Techlore and this video from Louis Rossmann for more info. Despite of that, I would say GrapheneOS is objectively the better operating system and it is what I use, very happy with it.