This is likely incompetence. PayPal/Thiel are deep state and for sure the CIA has all PayPal transactions.

So they'd want to enable an app trojan on GrapheneOS.

The question is why anyone would use GrapheneOS and use apps from hostile publishers?