They do the work for you. You could just buy a Pixel 6 and throw GrapheneOS on it, but this is not financially viable if you count the hours needed, especially if you want to recommend a secure phone to non technical friends and not configure it for them.