According to the FSF, GrapheneOS also contains non free firmware:
GrapheneOS is a version of Android which is described as “open source,” but it seems to include software that isn’t free software or even “open source”. For instance, it comes with firmware programs for installation and it appears that at least some of them are binaries without source code. It is said to be “de-Googled,” but includes a way to download and install the nonfree Google Play program.
Out of pocket I would assume nonfree packages and hardware shenanigans: binary blobs, etc. …
The latter imo is only really a concern if you’re being targeted hydrate actors, and you got bigger problems then
Mobian Bookworm contains 2 non free firmware packages: https://packages.mobian.org
According to the FSF, GrapheneOS also contains non free firmware:
https://www.gnu.org/distros/common-distros.html