Comment by mehdix

Writing this in GrapheneOS where Google Play and Services run just like another app in a sandbox. Moreover, there is a network access permission that allows you to block any app from accessing the network, which is surprisingly the reason why Google does not approve GrapheneOS as compatible to let it pass hardware attestation test (if enforced).