>Any device with Google services installed has all apps scanned at least once per day.

You can turn it off, so it's not "any". At best it's "most".

Also I daily drive graphene and that has no Google play services

Unless you want push notifications.

Then you can sandbox