The phrasing of your first question is ironic given GrapheneOS has upstreamed a ton of their security hardening.

You're probably asking if they're able contribute anymore?

Can you link to patches or commits they upstteamed? I'm not aware Google ever accepted any.