If the source is fully open (it is) than detecting and disabling backdoors is completely possible. Not to mention the fact that other OS projects face the same risks.
If Google cuts development of AOSP in favor of some closed-source alternative, the GrapheneOS team could simply continue development of AOSP on their own.