gnaabook it's encrypted but not protected by a startup PIN or Password.
Android has 2 different storage space :
CE (credentials encrypted storage) available when your profile is unlocked by your credentials. It protects your personal files and the ones created by apps.
DE (device encrypted storage) available all the time. GrapheneOS updates are done through this storage space. Registered Wi-Fi, Alarm settings or the apps names are stored in this space.
At the moment, it's not possible to create a PIN or a Password to prevent the OS from automatically accessing that space during boot and it will probably not be possible until GrapheneOS launch it's own phone.