Hi the above answers are correct that sandboxed Play Services are required for the install and management of the eSIM but not necessary post install as eSIM are also persistent if installed on stock prior to flashing GrapheneOS.

This must all take place in the owner or default user too not from a secondary user.

Also as you've mentioned other OSes run and use Google Services as privileged system apps with or without user consent.

GrapheneOS is a no Google by default.