EDIT: It was pointed out below by u/lukmly013 that SDR++ supports RTL-SDR directly. I have removed the rtl_sdr driver app and it works.

So, it is as simple as downloading the SDR++ app and enabling the USB-C port. No need to mess around with the driver app and its security settings.

This is a PSA as I could not find online whether a GrapheneOS would be able to run an SDR dongle or not.

I was skeptical about this working because GrapheneOS has several hardened security features and does not allow root access. ~~Since the RTL-SDR dongle is a USB device that requires coordination between a "driver" app and second SDR app I wasn't sure if such a configuration would work.~~

Conclusion: It does work!

I am using a USB-C to USB 3.0 OTG adapter and the rtl-sdr blog v4 dongle with a generic antenna. My phone is a Pixel 7.

The SDR app I have used is SDR++: https://github.com/AlexandreRouma/SDRPlusPlus/

~~The driver required is "Rtl-sdr driver", available via F-droid: https://f-droid.org/packages/marto.rtl_tcp_andro/~~

Both of these can be downloaded via Obtainium.

As for the phone settings:

Under "Security" settings, make sure the USB-C port is not set to "Off" or "Charging-Only".

In that same menu, if you see the sub-menu "USB peripherals", make sure that new USB peripherals are allowed. In my case I am almost sure that I had this sub-menu before, but I don't see it anymore.

~~In the app info menu of the Rtl-sdr driver app (long-click on app icon), toggle to ON the "Exploit protection compatibilit mode"~~

You should now be able to open the SDR++, click play, and find some bands.

This was enough to get the RTL-SDR to work in my phone.

Hopefully someone else finds this useful.