Entirely. On GrapheneOS, Google Play services run in the normal Android app sandbox, just like any other app you install. That way, they only have the permissions you granted them using the permission manager. GrapheneOS doesn’t grant any extra privileges, and you can remove the Play services app at any time. Read more at grapheneos.org/features#sandboxed-google-play