>The only thing you need to do is unlock the bootloader (which you cannot relock, like with Graphene).

GrapheneOS not only permits relocking, it prompts the user to do so immediately after installation.