It's possible they also have developers from the United States of America on the team
That seems like it would be at least an equally big trust issue. That is, if you trust the team in the first place that is, rather than trusting the third parties who look at the differences between AOSP and GrapheneOS