I don't think the attack can work as described here. One of the features that GrapheneOS lists is:

> Insider attack resistance for updates to the secure element (Owner user authentication required before updates are accepted)

From my understanding, this means that even if you do have the signing keys, you cannot install an update that would remove the need for knowing the screen lock to unlock the filesystem's encryption - as installing such an update requires entering the screen lock first.