There are two different Safetynet check levels. One (BasicIntegrity) is easily spoofable, bug GrapheneOS already passes that. The other requires Google certification.