Comment by hofrogs

It doesn't open up any holes since google play services are not allowed any special access on grapheneOS and run as a regular sandboxed app. You can make a separate user profile just for google apps.