I don't really know how this works, but if they have the cooperation of an OEM they should have the same access to AOSP security updates the OEM has, and access to hardware drivers from a company that's not trying to thwart them. I can see how this would be preferable to a basically antagonistic relationship with Google, who are making things difficult because they want all Pixel phones to run their stock OS. The thing I wonder is what motivates the OEM to continue a cooperative relationship with Graphene OS.