Have you thought why GrapheneOS has no option to update OS only via Tor (using exit nodes) or within Tor using .onion address?

Because they don't care about your privacy and security. Connections to  GrapheneOS servers can fingerprint you. 

DivestOS has an option to make updates via Tor. They have .onion address too.

https://discuss.grapheneos.org/d/10347-graphene-leaks-ip-during-update-if-vpn-connecting-but-not-connected