If they depend exclusively on the Google safety net attestation service this is true. GrapheneOS supports even stronger attestation though, they just have to choose to implement it properly: grapheneos.org/…/attestation-compatibility-guide