Custom ROMs have had just about enough of being Android's second-class citizens

What comes preloaded on Android phones isn't simply the Android Open Source Project (hereafter AOSP), but Android plus Google Mobile Services (hereafter "Google Android") and whatever customizations the manufacturer adds. One of the features of Google Android is a remote attestation service to prove to apps that the OS has not been modified. Google makes this available to its OEM partners whose operating systems meet certain security standards, called CTS, but not to open source projects like GrapheneOS.

On older devices, the remote attestation feature can be software-only, and that's easily faked. Newer devices support hardware-based attestation, which is not. A significant number of third-party apps refuse to run on devices that do not attestation, something Google makes no attempt to discourage. If you recall an uproar from the tech world when Microsoft was trying to push something called "trusted computing", this is the same kind of thing.

In the Mastodon thread, GrapheneOS asserts that many OEM Android ROMs do not actually meet CTS security standards while GrapheneOS does.

GrapheneOS supports the hardware-based attestation mechanism so that devices can prove they are running unmodified GrapheneOS, but apps using Google's attestation service will not accept that. GrapheneOS wants Google's mechanism opened to third parties provided they meet the same security standards.

Fully functional except for some key functionality like NFC payments which generally requires hardware attestation.