First GrapheneOS (and maybe e/OS? Not sure as I haven’t looked at them) is a fully featured OS and not a ROM. Second, it depends on the level of attestation, but GrapheneOS only passes MEETS_BASIC_INTEGRITY (again, not sure on e/OS).
And Google already “changed something drastically” as SafetyNet is deprecated (replaced by PlayIntegrity).