If you've read how law enforcement "deals" with privacy-focused projects over the years (specifically sky, encro, phantom, etc.) you'd know that they first start with a request to collaborate, then press and threaten. And it's not just one country doing it, it's done in collaboration - uk, france, netherlands, canada, usa, australia.
What's the most concerning to me is the possibility to infiltrate the project from within, as has happened with a lot of projects that were "not convenient" for the governement.
I think graphene leadership owes it to the community to explain how they are ensuring that they won't be compromised from an insider if pressed (imagine being a developer and law enforcement is threatening you with jail time if you don't collaborate).
And I disagree with the argument that sky, encro and such were designed to spy. They were not spying, until law enforcement infiltrated the project and pushed spyware to users. Anom is a different story as it was originally designed with a spyware. Open source helps in the case of GrapheneOS to identify a spyware being pushed, but considering there are so many updates and changes in the code on a daily basis, it's not reasonable to expect for a spyware to be identified fast enough before it may be too late.