

A few things to add to this:
Graphene adds new permissions: network and sensors. So if you don’t want an app to access the internet, it can’t.
Graphene also allows you to install Play Services, Play Store, and Android Auto, but sandboxed the same way that any other app is. For example I find Android Auto very useful and that requires Play Services, and the fact that I can get easier push notifications and the security of Play Store is nice. This also minimizes incompatibility for apps that use the Play Integrity API. If you’re going to do this I’d recommend making a burner Google account from Settings so it will allow you to use a VPN connection and not ask you for a phone number.
GrapheneOS removes Google’s location services and uses their own.
GrapheneOS supports multiple user profiles, and apps can be pushed from the owner profile to other profiles. So you can havw some profiles with or without Play Services, further sandbox sketchy apps you’d rather not have to use but are forced to, separate work apps, have multiple accounts for apps like Signal that only support one account, etc.



You can export and import Totp codes pretty easily with most apps I’ve tried. Except Microsoft’s.