If the app could be signed with the build keys for GrapheneOS, wouldn't that do the trick and make it seem like a system app, granting it the privileges it needs to work? I don't know what signature scheme it uses currently, probably v3 or v4, which in that case it won't work and there's no chance of rebuilding it, but if by chance it is v2, then it will accept a second signature and may be possible to sign the app with the GrapheneOS build keys.
No root or system mods in that case...