This will be a long one, so bear with me :)
TL;DR try 16 digits code to pair or better try as long PIN as your car and your phone allow you to use.
There's a very interesting document with NIST recommendations regarding Bluetooth 2.1 and how it all works. Mind you, it's a 2nd revision from 2017, meaning there were changes. The juicy part starts on page 23 in part 3.1 where it says that an additional 4th working mode was added that mandates encryption for everything (including pairing), but not for device discovery.
If we imagine, that the discovery part works (which it does in your case), and the encryption can't be properly established, since the car is old, hence its Bluetooth stack is old and probably lacks patches for the mentioned 2.1 version, we can (tentatively) conclude the head unit needs an update (if this update even exists).
One more thing. In 3.1.1.1 (page 26) the document says (emphasis mine):
For PIN/legacy pairing, two Bluetooth devices simultaneously derive link keys when the user(s) enter
an identical secret PIN into one or both devices, depending on the configuration and device type. The
PIN entry and key derivation are depicted conceptually in Figure 3-2. Note that if the PIN is less than
16 bytes, the initiating device’s address (BD_ADDR) supplements the PIN value to generate the
initialization key.
We know that GrapheneOS strives to use the latest stable, secure, and private drivers for our phones. We know that in recent years Bluetooth stack worked on privacy and less trackability a lot. My knowledge on the topic is basically nonexistent, but I'd imagine that Bluetooth MAC addresses and their spoofing (for the lack of a better term) would be involved, and your car with older Bluetooth stack may be aware of this. Of course there are standards, versions, and other stuff. But maybe there's a glitch somewhere between those lines which affects part 3.1.1.1 (PIN/Legacy Pairing) of this document, and you could work around it using a longer PIN for pairing.
From the document we know that to avoid substituting or adding a part of BT MAC address to your short PIN we need to provide a 16 bytes PIN. If we assume we need 1 byte per character (which may be not the case), maybe try 16 digits code to pair or better try as long PIN as your car and your phone allow you to use.
3.1.2 and 3.1.3 parts of the document claim to provide even more details on how this all works, but I didn't go that far.
Of course all this is based on a lot of assumptions and lack of proper knowledge on the subject.