Builds are reproducible [1], so you can compile them yourself and check they match the official ones. Additionally, official releases are signed and the update client verifies them and prevents downgrade attacks [2]. You can also install updates offline from a computer if you prefer [3].

[1] https://grapheneos.org/build#reproducible-builds

[2] https://grapheneos.org/releases#about-the-releases

[3] https://grapheneos.org/usage#updates-sideloading