how can grapheneos be audited if motorola/qualcomm doesn't provide source code for their blobs? it's no different than pixels, but I trust Google more.
Blobs can be decompiled and examined. Closed source code isn't a black box. Security research can be done on it in various ways.