> It's not like Google is going to sell your tracking data to abuser.
No, that's exactly the fear. With enough disclaimers and third parties involved, a motivated, highly intelligent and rich attacker with the right connections could get that information.
Explain how (in comparison to GrapheneOS) please.