That's exactly how modern Android rooting tools work. You select which apps you want to have root, in a manager app. No other app should be able to notice.

But GrapheneOS isn't root, that's just PayPal's thing being broken.