Yes, it is. It's the reason Graphene says themselves. Graphene is all about reducing potential attack vectors, de-googling just happens to be in line with that goal. An unlocked bootloader is a massive security vulnerability.