GrapheneOS is built to work with a locked bootloader, in fact, relocking the bootloader is a step in the installation guide. It’s not rooted by default and the GOS team highly recommends against rooting, all apps should work as long as they only require SafetyNet basic integrity. If they require full integrity, they won’t work on GrapheneOS because the OS has to be manually whitelisted by Google in order to pass the full integrity check. Most apps (including banking or government apps) only mandate basic integrity though, full integrity is rarely required. It should definitely work better than LineageOS.