Yes, AOSP includes a lot of GPLv2 code and we use GPLv2 licensing ourselves including for our Vanadium browser project. We don't want GrapheneOS to be more restrictively licensed than the Linux kernel and AOSP so we avoid GPLv3 code bundled with the OS. GPLv3 is perfectly acceptable for apps in our App Store but we don't want it for the ones in the OS.

Yes, the GPLv2 license does not have the same restrictions GPLv3 does, it does not necessitate making the code it is bundled with GPLv2.

Linux is GPLv2, though. Not sure if that makes a difference here.