I'm guessing they could, in theory, attack open source projects, but it would not be very effective as those could be infinitely forked. That's the reason why governments will actually support an encourage an oligopoly of proprietary platforms via regulations (e.g. mandatory automated scanning) which only companies can practically comply with.

There's no way to obtain root access on GrapheneOS without making your own builds (which won't be affected by many of the apps adding support for GrapheneOS, who likely would only whitelist the official signing keys) or keeping the bootloader unlocked in perpetuity (because AFAIK there is currently no way to recalculate verified boot hashes on top of a systemless root like Magisk -- not that I even know if that works on GOS in the first place). Some years back I was actually working on calculating AVB2 hashes from a live system rather than ONLY through the Android build process, until TWRP wiped my phone without consent or confirmation due to an OpenRecoveryScript that I absolutely did not put there and I basically stopped tinkering with Android root due to that. I have an iPhone nowadays.