Samsung did restrict side-loading recently,

- https://news.ycombinator.com/item?id=47202808

I'm sure that Google will do something like that as soon as it faced the US's carrot and stick they signed-up for.

This is how you can install GrapheneOS on these. Also, if you're wondering how does the security of something like this work: if you change the boot hash then the phone forgets all the hardware-stored secrets, for example the disk encryption keys.