This exactly. I have a FOSS app called VirtualXPosed installed (although I never use it anymore), which creates a "virtual android" in which apps can be installed and be manipulated in ways that would normally require root, despite me not having it on my phone.
Despite having "play protect" disabled, google still constantly sends me notifications about it being harmful.
They have Google services but through a third party wrapper called MicroG, which keeps it sandboxed to a degree that you can keep it from doing system-level actions like this
edit: not microG, as evidenced by the strikethrough I put in very soon after receiving the first of several replies clarifying the situation. I would encourage you to read one of them before adding your own. <3
It definitely helps. In GrapheneOS, Google Play Services can be installed, but it is sandboxed and doesn't even have network access unless you allow it.
It solves so much more though, like through scoping you can give an app access to your contacts, or just specific contacts; to the app, those specific contacts are the only contacts that exist on your phone.
Despite the typical moaning from this community any time Android changes anything, this is a good thing. This will combat a new scam tactic that's been going around where scammers call their target, pretending to be their bank or somebody else the mark would be doing business with, and ask the victim to install a "security update" to their app. They get the victim to install a look-alike app, and then have all their data and money stolen. YOU probably won't ever fall for such a scam. But your grandma absolutely will.