By design, this app isn't mandatory. There should be an alternative way to do age verification. If you can't access a service because you can't run the app, the service fucked up.

Furthermore, there's nothing stopping the governments implementing these standards from permitting GrapheneOS' signature. It's one of the ROMs that actually has a reliable signature so unlike random images from XDA there's a case for it to be permitted. Google's integrity check isn't just a binary check, it's a combination of a hash and a pre-defined list of suggested acceptable hashes.