They didn't "ban" them, but they did enable some attestation feature that effectively "bans" anything that isn't Google Android.
Which still makes you wonder why Volkswagen is so keen on alienating what little is left of their customer base with completely stupid security theater.
It's fair to say they banned GrapheneOS but they didn't only ban GrapheneOS. It's very rare for apps to specifically ban GrapheneOS but Revolut uses an SDK which tried to do it. We worked around it and Revolut works on GrapheneOS since January 2025 but not for lack of trying to ban it by an SDK they use and it sometimes blocks our users.
The people at VW don't think about the customer. They are essentially bureaucrats who only live to expand their personal fiefdom in the bureaucracy. I bet that many in the IT-security team would insist that their team doesn't have customers.
Because the EU is run by lawyers and lawsuits. They probably decided there was a risk of being sued for insufficient security if they didn't enable every security feature, and they considered it as zero impact to customers because nobody uses graphene.