Custom ROMs should be able to disable the checks. My bigger concern is what it does to the open app ecosystem as a whole.

That defeats the entire point of the project, there are other custom ROMs that significantly improve privacy and security on non-google phones. What’s accomplished by graphene supporting them?

They supported Google because it was the only device with the hardware security features they needed

A midlevel director who doesn’t use the tool but thinks all the features the salesperson mentioned seem cool