They even have reproduceable builds so you can validate the source matches the distributed binaries. After that it's trusting in the OSS process to have caught any attempted backdoors which is more down to your individual evaluations.

https://grapheneos.org/build#reproducible-builds

For more on this subject, here's a book that documents it: https://www.amazon.com/Dark-Wire-Incredible-Largest-Operatio....

Would be an interesting experiment actually: how long would it take for the community at large to discover a backdoor in graphene OS if added sneakily by generally trusted Devs, ie the org that maintains it.

Or, phrased differently, how much independent auditing is graphene OS subjected to?

Wouldn't be hard to hide a backdoor in a multi million line codebase ...