They do the work for you. You could just buy a Pixel 6 and throw GrapheneOS on it, but this is not financially viable if you count the hours needed, especially if you want to recommend a secure phone to non technical friends and not configure it for them.
Just found their "About the company" page: https://www.nitrokey.com/about
They say that they are totally self-financed and produce their Nitrokeys only in Germany to prevent supply chain attacks.
I am using their FIDO 2 USB-Keys for 2FA. First I was sceptical too, but they are on the market for quite a while and I like their fully FOSS approach which Yubikey does not provide. Some of their products seem a bit overpriced, because you can do everything by yourself, but if I count all the hours and days spent with unlocking Bootloaders, searching ROMs and debugging them, this offer seems worth the price.