I think "for certified devices" is the key there. If you unlock / de-certify / graphene should be OK. Problem is high trust apps like banking apps will immediately demand certified only