But then they don't allow me to have root at the same time. They claim it is for security reasons but fail to explain why and get really unfriendly. Maybe some power-trip? So now I can choose between vendor lock-in and random-programmer-lock-in.

The GrapheneOS developers like to talk as if relocking the bootloader is unique to Google Pixels and providing a custom key is unique to them.

But that's not true. Every OnePlus device in the last few years allows avb_custom_key as well, Xiaomi Mi A2 does too, probably many others. And ROMs like Pixel Experience publish their custom keys too.