Johnnyloans Yeah, I guess I am just talking in hypotheticals.
Realistically speaking, the url I visited when I flashed the phone was the legit grapheneos.org website, the images were legit and the phone is ok.
Just the fact that I overlooked verifying the url "just to be sure", makes me question the whole process and theorize about a potential exploit having occurred.
There are no such signs of an exploit having occurred. To the contrary even: the website looked legit and the verified boot string matched.
I guess sometimes hyper-vigilance and being overly cautious and then overlooking a crucial element can lead to an "exaggeration of reality." I am in no way someone that should fear being targeted by such sophisticated exploits and in fact can't see any adversary being interested in my person.
The only way me being affected by an exploit could make sense is if there exists a copy-cat website of grapheneOS that I stumbled upon (typed url by hand), is not registered in google safe browsing, has a valid https certificate, has the time, resources and expertise as well as zero-days that is openly targeting anyone that tries installing grapheneOS.
So, realistically speaking, I do not believe that the phone was compromised. The thread was more of a way to assure myself and further reduce the "chance" of an exploit in my mind.