n3t_admin
Why braindead? It could as well be a company with a very lean internal IT service desk, that doesn't want to bother with the non-standard mobiles (GrapheneOS doesn't support standard MDM well even though there's a company trying to donate their code)
So imagine a company with highly valuable IP (say, successful trading company) employing maybe 20 people, 10 of which are very "vulnerable" targets for APT.
GrapheneOS seems to be a natural solution if someone got burnt with iOS already. So if there's company offering a turnkey solution for secure mobiles? Why not, it's peanuts for them. And if their platform support earns a decent market average, it's much CHEAPER to pay someone for this than have your own people figure it out.
So if there's a company like Nitrokey or Teuton-systems, they simply respond to the market needs. And yes, it's possible to establish if the company can be trusted.