They could also just sell the phones with GrapheneOS already, as the final state of a GrapheneOS instalation has a locked bootloader.
I understand this is part of the reason only Pixel phones are supported - the ability to unlock, and then relock bootloader after install is seen as essential by their team, among other features and properties that only present together in the Pixel phones.