You can still be part of a project without being lead, to be part of the “we.” Did he contribute and/or is he part of GrapheneOS, yes? So he’s part of the “we.”
Or does only the lead developer get the “we?” Wouldn’t that make it more of an “I” instead?
CalyxOS is not a hardened OS, and GrapheneOS requires more than than just relocking the bootloader.
Ref: https://discuss.grapheneos.org/d/7208-8y-security-updates-on-fairphone-5-will-the-devs-consider-porting-grapheneos