It would need to be more than that, since a lot of projects like that end up being dead wood that isn't maintained, and therefore don't end up being secure at all. We'd want an OEM to build since there can be some assurance there will be maintained security updates and patching for years down the line. GrapheneOS needs the same requirements or effort Pixels have, else there's security or functionality shortcomings and it misleads our users.