I believe it's a question like his can a Foss ROM like graphene limit/block something bad from Google's firmware. It would be ideal (and the biggest problem ATM) to have Foss firmwares in that regard.
Discussion
I would like to believe that the firmware just hashes the biometric signals and forgets about them. But I found nowhere that verifies this.
A lot of faith in that process...I see degoogled as a temporary solution as it's still made by google "aosp". IMO the final solution is something like a pinephone, with a risc-v SOC and risc-v modem, with Foss firmwares.
Is quoting Daniel Micay useful?
https://www.reddit.com/r/GrapheneOS/comments/f16p7o/comment/fh4vrj3/