they say themself they are basically using this
https://developer.android.com/work/device-admin
this sounds like a rather invasive app tbh.
the documentation says:
"Perform data wipe
You can use the DevicePolicyManager method wipeData() to reset the device to factory settings. This is useful if the device is lost or stolen. Often the decision to wipe the device is the result of certain conditions being met. For example, you can use setMaximumFailedPasswordsForWipe() to state that a device should be wiped after a specific number of failed password attempts."
So the use case is covered and it is basically all provided by android itself.
How good this works, i am not sure. I believe i heard the GrapheneOS account mention, that wipe after x attempts without hardware to back it up, can not be relied on.