>You could re-compile your own copy with root access, though not sure if we'll then be back to some non-certified OS that can't make payments...

GrapheneOS is already non-certified, for most apps that care, because it can't pass STRONG_INTEGRITY with play protect.