Builds are reproducible [1], so you can compile them yourself and check they match the official ones. Additionally, official releases are signed and the update client verifies them and prevents downgrade attacks [2]. You can also install updates offline from a computer if you prefer [3].
[1] https://grapheneos.org/build#reproducible-builds