I put GrapheneOS on the phone myself.

I wouldn't trust the OS shipped with a used phone.

NSA could technically do this with a new phone also and probably has.