https://github.com/sailfishos/sailjail-permissions/blob/mast...
Given how sensitive information most people have on their phones (banking, chats, and whatnot), it's a disaster in the making.
The typical answer is "but I'll only use open source apps that I trust". Sandboxing doesn't only protect you against rogue apps, it primarily protects you against 0-days in apps that you do trust.
If you are worried about big players profiling you (hard to avoid, high likelihood of happening, low likelihood of damage), then you want Sailfish.
If you are worried about apps profiling you (easy to avoid, high likelihood of happening, moderate likelihood of damage), you want Android or iOS.
Graphene and Sailfish sit on different points on that spectrum, just like OpenBSD and Linux do.
Even if you choose not to install Play Services/Play Store, you will still have access to many more apps than on SailfishOS - from many open source Android apps to proprietary apps that you can download without the Play Store. Plus, with the Linux terminal support in Pixels (note: not all Android phones support this, e.g. Snapdragons don't support privileged virtualization), you can also run Linux desktop apps.