You don't seem to understand how play service / MicroG work. Maps or Auto Apps aren't the ones having the privilaged access but Play Service and MicroG.

>NetGuard would warn me if it did. I would assume it is not even running when I disable it

Since play services/microg have higher privileges than NetGuard they could just bypass it.

>But avoiding Google (and other big tech) is the reason I am not on a cheaper and more convenient phone with regular Android, so if GrapheneOS refuses to support an alternative to Google Play Services, I'm not too happy about it. If there are real problems with microG then I'm sure the authors would be interested in a better solution too.

That doesn't make any sense at all. GrapheneOS by default has _0_ Google connections unlike LineageOS, /E/ or any other AOSP fork. MicroG is not an alternative to not using play services at all = actually avoiding Google, but a open source reimplementation that still has all the privacy and security issues of regular play services. GrapheneOS sandboxes Google play services only have the privacy issues since just like with MicroG you still connect to Google = not actually avoiding Google.

The issue with no notification without play services can be easily fixed by not using privacy hostile apps which only work with them.

https://www.kuketz-blog.de/e-datenschutzfreundlich-bedeutet-...

When I tested /e/OS a few months back, I found the same.

(which is easily done, as opposed to stopping Google Services in GrapheneOS)

This is incorrect. By default, GrapheneOS does not even have Google Play Services, it is something you have to install explicitly through the GrapheneOS App Store.

I can even survive the icons.

What is the problem with the icons? Only their own icons are black/white. If you install other apps, they'll just have their standard icons.

if GrapheneOS refuses to support an alternative to Google Play Services, I'm not too happy about it

As I mentioned, you can use it without Play Services, it is not even installed by default. But if I have to choose between sandboxed Play Services or privileged microG which loads Google binary blobs into that privileged process (for SafetyNet), I will pick sandboxed Play any day.

That's besides them doing many other weird things. Like their App Lounge does not install F-Droid apps directly from F-Droid, but through middle-man proxy that they do not want to reveal the owner of (cleanapk.org). That combined with Android's TOFU security model makes it a vector for rolling out backdoored applications or intentionally delaying app security updates.

Either they are incompetent or they are malicious.

If there are real problems with microG then I'm sure the authors would be interested in a better solution too.

/e/OS does not use vanilla microG, but their own fork of it.