feifeipig Also I heard android allow apps to read list of installed apps on the phone?
Only apps in the same user profile.
feifeipig Is that the same with GOS?
Yes
feifeipig Anyway to block this permission?
No. Use a different user profile, if you are concerned about it
feifeipig Is there any way for a bad app to escape android sandbox?
Sandbox escapes on Android have been rare, but they happened in the past. But it's usually only a concern with sophisticated malware (e.g. from state-level actors). GrapheneOS's sandbox is stronger than stock Android's, but you still won't have 100% certainty that it will not happen.
feifeipig Is it much better or no big difference to install in different profile?
It is still the same sandbox. Just some access is different (no IPC and no app listing cross-profile).