the debate on microg v sandboxed GPS is not settled tho

for example with sandboxed GPS you have option to cut network connection to GPS both store and service and maintain functionality of most apps

while with microg you are still pinging google with the spoofed identity

furthermore, microg is generally used in deployments like lineageos which is inherently insecure while buying decently private because bootloader is not locked unless it is pixel and because it is running in debug mode.

I think calyx upgrades on this decently from OS perspective.

Nobody should be going to a protest with their MF bootloader unclocked, bottom line.

GrapheneOS also has several hardening upgrades deployed through out the OS that is lacking in stock android. This upgrades are critical if your concern are state actors who have access to the best and freshest zero days sometimes know as backdoors depending on who you talk to.