The points that @pxlkng has made in various threads, eg some recent ones here https://discuss.grapheneos.org/d/19725-auto-update-apps-through-aurora-store and https://discuss.grapheneos.org/d/13828-automatic-aurora-store-update-start-of-aurora-store , have sparked a lot of discussions even on forums beyond such as this recent one in reddit: https://www.reddit.com/r/degoogle/comments/1l6msli/aurora_store_is_absolutely_not_recommended_by_the/.

I've been trying to keep up. Firstly, thanks to all those involved since I have myself come to know so many things from points made by @pxlkng and GOS mods and counterpoints from many others.

Since, like many, I too use Aurora Store (AS), I wanted to understand the concerns about privacy and security from those recommending against using AS given certain scenarios and steps taken to mitigate some alleged drawbacks.

I have setup GOS to use the owner/primary profile only to install apps, immediately disable them and then push them to the secondary profile(s) where they are actually used. This keeps the management centralized and I don't have to install them in each profile I want to use them.

I do this with Aurora Store with anonymous login option.

Right off the bat, my IP address is no longer revealed to Google as stated in the AS wiki: https://auroraoss.com/wiki#:~:text=as%20all%20sessions%20are%20generated%20via%20our%20server,%20so%20only%20our%20server's%20IP . This alone means that if only my owner profile is active, I don't have to actively remember to disable Play services etc (or deny networking to them) when I'm on the move. This gives privacy - I'm preventing play services from actively tracking me as I commute to various places.
Next, I install non-privacy invasive apps in my secondary profile say p2. These can be email apps like Organic Maps or Tuta or Proton or whatever (just for the sake of argument assume that these didn't have google code or reported/colluded with google). Google doesn't know I installed them as AS makes request from an email address and IP that is shared with many others. The device architecture etc would also be used by many so I cannot be singled out. On top of that, there's also some amount of spoofing that AS allows. This again is privacy.
The apps that require play services or are privacy invasive anyway, like social media apps or Gmail/google-maps etc which either directly talk to google or collude and share info under some agreement (banking apps), get installed in a separate profile - p3. Sure as long as I log into that profile, google knows who/where I am and whatever info is collected. There is no difference here between play services and AS. However the big point is that I can just kill the profile session and then be completely invisible to Google until I turn that session back on again. If instead I had used Play service in owner profile, I would need to additionally remember to tinker with owner profile and this is otherwise a needless step that I need to perform or it harms privacy for both points (1) and (2) above. And for those who don't need this point (3) at all, even better, there's nothing to do here.
For security side of things - AS now has certificate pinning so that criticism is no longer applicable.
It doesn't however verify signatures of the downloaded apps. This is the only thing that requires (an easy) workaround. As I understand, thanks to Android OS itself, you cannot update an app if the update has a signature mismatch (ie signed with a different key) compared to the currently installed version of the app. This means you merely need to make sure the 1st installation isn't malicious. To do this, according to recommendations, simply use an alternate phone with throwaway google account (or use friend's/family member's phone) to download apk via play, get its certificate hash, come back to your device, use AS to get the app and use AppVerifier to check it has the same certificate hash. Problem solved. For a good majority of apps you will likely have it in AppVerifier's internal database itself so no need to do all this, only for those whose certificate hash isn't in AppVerifier you do this. It's better to focus to improve AppVerifiers internal database which would make this security concern go away for vast majority of the apps. Until then you have a workaround.
Auto-Updates are a PITA on AS. I don't know of a solution to this. Currently I just make sure to check it at-least once a day, click on check-for-updates and then it springs into action and gives me list. Press update-all and things are updated normally. I personally think this is an OK usability compromise for the sake of other gains. In-fact I would argue that GOS asking for pin/password to profiles every so often (I think 48 hrs) is actually more of a security+privacy concern. It has asked me at times when I'm in a supermarket or under surveillance where I feel uncomfortable entering the pin/password. This also isn't configurable. So I need to remember to log into all profiles once every 24/48 hrs anyway. I just add manually checking for app updates on AS as an additional step to that already existing chore.

So I fail to understand why such drastic statements from both @pxlkng and GOS team that it's categorically less private to use AS or that it brings no gain to using Play Store? I'm so far finding it quite the opposite.