Most of these exploits involve side channel attacks which are much closer to the hardware. Graphene definitely does a lot more to make that difficult, but typically devices are getting pwned within a few months even with graphene.

Having graphene on relatively new hardware is a really good practice, but it obviously isn't a complete security posture on its own. Not having sensitive, compromising or incriminating stuff on your daily carry phone is much more important.

I remember one cybersec company got hit with an internal communications leak that suggested they could get into any GrapheneOS device before the Pixel 9, AFU or BFU. They were still having trouble with BFU Pixel 9. But this was a year or two ago.

Device wipe before capture/seizure seems to be the highest guarantee.

I'm sure they spend time on Linux in general, since it is the most common operating system (and includes Android, so even bigger). I doubt they spend much, if any, effort on the specific subset of systems that make a Linux phone different from another Linux device.

Smartphones had been vulnerable for pretty much it's entire existence, and most of time, while true software do play a role, it's been more about stuff such as bootloader exploits.

Sadly Linux phones on it's state are insecure by design.