As several others have already said here, GrapheneOS is not necessarily rooted. So that's a lie.

Also, I've seen such audits internally, and they don't care about security at all. They care about the theatrics of security waaaaay more.

For example, I was at Santander in 2024, during its huge data breach. Here is the list of actions which are supposed to prevent the same kind of attacks again in the future:

-

Yeah, it's an empty list.

But of course, they made our life more difficult. In the end, I literally had more permission than before, because they were even sloppier than before. But of course, I had to change my password more frequently, and I had to type it about 5x more.