We have heard about this as well. It is not a surprise that a brilliant technical founder found himself having to step away as the "face" of the project as this happens to most companies private, public or open source. We've read both sides of the situation and "drama" that unfolded and are still very much of the belief that the code and operating system itself is still the most private and secure operating system available.
We've been assured by the team and can see through their consistent updates that GrapheneOS is still actively being worked on day to day and hasn't missed a step. This said, if the project dies for any reason, then there will no longer be updates to the operating system moving forward... unless or until a new team picked up the project to continue the work.
The same would be the case if a private company that built a phone or OS went out of business... unless someone stepped in to buy the business and continue the work.
If no more updates are coming through to the device, that would mean that should there be vulnerabilities found in the future, updates to the operating system will simply not be sent or received... however, the device will still be as secure as it was as of the last update received.
Is there a risk that the entire project will blow up? Sure... anything is possible and it's ridiculous to say it will NEVER happen. Do we believe the risk of this happening is remotely plausible right now? No. Do we think that the risk in using BigTech devices and operating systems is FAR greater than the risk outlined above? Of course... or we wouldn't be doing what we're doing!
Hope this helped add some clarity and sanity to the question and concern.