beppi The login works perfectly fine in another profile...
I assume because you gave Play Services the network permission during install time. You can either give it the network permission during install time, then revoke it immediately after the installation has completed (that appears to work), or you can install it without the network permission being granted, grant it for about 10 seconds, revoke it again, and reboot your device/profile. I just tested the latter in a fresh profile.
beppi That's interesting, I'm hesitant to try though: I'm unsure what kind of info gplay will ship off to the mothership if I do that though... Do you have an idea of what the downside is of giving gplay network permissions even if just for a moment?
It can gather and send off data like any other app. As to which data specifically it actually sends off, I guess someone would have to use an MITM proxy on a development device in order to investigate that. What is clear is that Play Services needs the network permission in order for other apps to outsource push notification functionality to it. And, as appears to be the case, communicate with some server for a few seconds in order to activate certain FIDO functionality.
Keep in mind that many apps use Google libraries anyway, so unless you have no apps on your device that contain Google libraries, there is still Google code on your device that probably sends off some data – although exactly what data that gets extracted I do not know.
As to how all this relates to your personal threat model, I cannot answer.