Their license is invalid due to being GPLv3. GPLv3 cannot be included in GrapheneOS as that would necessitate GrapheneOS give up their permissive licensing.

Refra Gallery is licensed as Apache 2.0, which is a permissive license GrapheneOS can bundle in the OS.

We're going to be forking one of them (ReFra). We want to make extensive changes and have a different vision for it than the upstream project. For example, we don't want it to have integration into services. There's plenty of room for both an increasingly different fork of it in GrapheneOS and the original project which our users will continue to use who want features we don't consider inside the scope of what we want from a local gallery app.

Media handlers are a security nightmare, might lead you to the right answer if it isn’t it.