It was always a security risk because google has always been spying on you…nobody is forcing you to buy android phones.
I have plenty of issues with Google's posture on privacy, but I don't expect them to steal credentials for other services, drain my bank account, blackmail me based on personal information, or any such thing. Conflating the two removes a lot of much needed nuance from the discussion.
Ironically I hated financially supporting Google but felt I had no choice but to get a Pixel to use GrapheneOS and have 5 years of security updates