Without piling more on GrapheneOS, my take is that the pragmatic approach would be to just include espeak-ng until a better solution comes up. If companies want to use GrapheneOS, they can simply remove this component.
Security concerns? IMHO, after initial setup there's no need for espeak-ng anymore and can be replaced by something else.
But of course, that's just my position. I guess it's too late for a pragmatic approach now.