OK not sure about that will do some reasearch myself, but a photo of them saying they did it in a YouTube video is a weird piece of proof
But my point is that grapheneOS doesnt require the bootloader to be unlocked or root the phone which itself is the main defense in your phone from those attacks so unless others dont unlock the bootloader they are just worse for that reason alone. From 2022 but still relevant Article on bootloader and rooting