If they replaced the core of the OS with a rootkit, it wouldn't be GrapheneOS anymore but rather a derivative of it. They didn't do that and people should be clear if they have rather than calling it GrapheneOS.