Things like cellebrite and pegasus are rapidly evolving tools based on specific zero day vulns that are known only to (and jealously guarded by) the respective tools devs. No one would have any meaningful way of validating whether Graphene is secure against those specific attack vectors or not unless they did test it, but “trust me bro” on the part of a dev doesn’t inspire confidence. I would assume any zero day vuln in AOSP is very likely present in most derivative systems based on it.