GrapheneOS strongly recommends that you do not do it, but it will not stop you if you want to. You can root and leave your bootloader unlocked or create a custom user signed image with root support included. Plenty of user written guides out there how to do so.

Locking the bootloader is important as it enables full verified boot https://grapheneos.org/install/cli#locking-the-bootloader

> You can root and leave your bootloader unlocked

That's Google, not GrapheneOS.