I think Graphene spoofs the most basic level of Google's security thing but they never wanted to spoof anything higher because it would just turn into a cat and mouse game that they would eventually lose.

They recommend that app developers adopt the much stronger and vendor-neutral Android hardware attestation API instead.