They have many more permissions than what the permissions list shows you. Many apps for example can read your device IDs or start at boot.

I know this specific case wouldn’t apply to a degoogled phone, but Google Speech Synthesis was getting mic access despite the permission being denied. I know because my permission killer would randomly tell me the app gained the permission and ask if I wanted to revoke it. The mic was turned off and the permission was denied in settings. The fact that that app could do it, made me suspicious of Android as a whole. If I can’t install apps like Bouncer, I would have no way of knowing I can trust Graphene.

And the way my Pixel handles root is the same as Linux. On Linux, I have to type my password whenever SU is needed. On my pixel, I have to do biometric authentication every time SU is requested. The only security flaw is that I leave the bootloader unlocked in case I brick it