Fundamentally here, the issue is that in the TCG TPM implementation specs, PCRs 8-15 are "Defined for use by the Static OS", and Linux and Windows have, reasonably, chosen different things to use them for.  This makes using TPM passthrough challenging.

Regarding grub's usage specifically, we're using 8 and 9 to measure the bootloader configuration and kernel command line (8), and the kernel and initramfs being booted (9).  Because this is boot information, and we're merely creating records for something to use later, it's not like the BitLocker use case, but rather the same reason bootmgr is still extending them[0] even if you change the group policy for BitLocker. we definitely can't make changing them be an install-time or configuration option - that creates several bad scenarios:

1) anything that has hard-coded the PCR they're sealing against accidentally seals against an uninitialized PCR
2) anything that doesn't have them hard-coded now has to look up which ones to seal against, which creates a race condition where an attacker can cause the producer and consumer to believe different sets of PCRs are in use.  This potentially leads to encrypting with an attacker's key, or doing attestation with a PCR that only the attacker has ever extended anything into.

Making this configurable either at runtime or during the build opens you up to these problems if the attacker is present in the right time frame during initial provisioning or any recovery procedure, and we can't change that for just one customer who needs it; it poisons the well for everyone.  That said, IMA using PCR 10 is configurable at kernel build time, so possibly that is more flexible[1], but I don't think there's a reasonable way to get around 8 and 9 being used for cross purposes by each OS.

I really think the only answer here is to use swtpm to provide the guest TPM, and use IMA and/or LUKS to secure the swtpm data, instead of trying to do pass-through.

[0] as noted here: https://bugzilla.redhat.com/show_bug.cgi?id=1734505#c51
[1] Incidentally, I'm still not sure why PCR 12 is changing in https://bugzilla.redhat.com/show_bug.cgi?id=1734505#c41 , especially as https://docs.microsoft.com/en-us/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings makes no mention of it.