What does it mean for an OS to be ported to another OS? Do they mean "ported to devices that support Android"?
Android makes yearly releases. It is developed in cathedral-style. Google releases the source as a single big update. GrapheneOS is a fork. They need to port their customizations and extra software on top of the new release.
It's a fork of the Android Open Source Project (AOSP) with major privacy/security improvements and alternatives to Google apps/services. The massive set of changes needs to be ported to new major versions of AOSP.
The apps also need to be updated to the Android 17 target API level but that can happen over several months following the OS itself being ported to it. The app aspect is something all Android developers need to deal with due to new target API levels bringing backwards incompatible improvements.
Think of GrapheneOS as being a set of patches on top of the Android Open Source Project that Google releases:
They've ported the patches to work on top of the latest release.
Well, both, probably. GrapheneOS requires a lot of framework and device side changes.
It means they rebased all their changes on top of the new version. This is usually time-consuming because AOSP is not developed in the open, so you can't do this incrementally as things change -- you just get a massive drop sometime after release.