de0u Which problem?
In the article, reiterated below that sentence.
I see a lot of things in that article, some of which I don't see reiterated in your post, e.g., "the phone periodically attempts to download and run new code, potentially opening up security risks". Also, "the Pixel device periodically contacted endpoints associated with Google Photos’ Face Grouping feature without asking for consent", and "Worryingly, we observed CloudDPC reaching out to Google’s servers". Hence my question.
de0u Lots of GrapheneOS users don't install Play at all
ignition Not sure what this speculation is based on.
Maybe people here (other than me) who don't have Play installed will chime in, in which case it won't be just speculation. But if the discussion is held to just speculation, there are a lot of posts from people who have installed messaging apps and/or e-mail apps and ask why notifications don't work, and are told that installing Play is necessary, and say they don't want to. There are also posts from people having issues with the ntfy variant of Molly, and people complaining that Proton, years after saying they were working on non-FCM notifications, are still doing only FCM notifications on Android. I admit I am merely speculating that those posts are substantially from people who don't have Play installed.
de0u or install it in a secondary user profile.
ignition Other than app list, using a secondary profile is irrelevant to the things listed.
If you say so! However, one of the upsides of secondary user profiles is that they can be stopped, so one can limit whatever surveillance one assumes the Play infrastructure is carrying out to specific times and places.
de0u But it seems pretty clear that installing GrapheneOS and not installing Play would be quite effective at cutting off the telemetry reported in that article.
ignition Maybe, but not sure why that matters when the Play Store is the recommended way to install apps and is practically a requirement for banking and ID apps.
I believe the position of the GrapheneOS project is that Accrescent is the most-recommended venue. I believe the project's position includes that apps available on the Google Play store are most reliably and securely installed via the Google Play store (as opposed to via Aurora or various "APK mirror" sites). I am unaware of a recommendation or expectation from the GrapheneOS project that all users install Play and install apps from the Play store.
ignition People do not 'choose' to run the Play Store on a regular Pixel. They may 'choose' it with Graphene but unless you ignore developer recommendations, trying to use the device for ordinary banking or government ID apps will require its installation in the majority of cases.
I think (or, if you prefer, I speculate, based on forum posts) that some users choose to bank via web app instead of via bank app. Perhaps that avenue will become less viable, or perhaps more banks will choose to improve their apps. Likewise, governments may increasingly require Play (and may increasingly require the stock OS), or not. People who have a government i.d. app may choose to mitigate tracking by isolating it in a secondary user profile that is activated only occasionally (something that is possible on GrapheneOS and not on the stock OS).
Overall, as I previously wrote, it would be great if somebody would re-run the experiment reported on in the article using GrapheneOS instead of the stock OS. Perhaps the researchers would be interested in doing a followup comparison study.
But it does seem very likely that some of the issues raised in the article (e.g., "CloudDPC") are 100% remedied by installing GrapheneOS, and it also seems very likely that Play tracking issues can be mitigated by users willing to isolate the Play code in a secondary profile (an enhancement of GrapheneOS over the stock OS), and that Play tracking issues can be completely avoided by users who are in a position to forgo banking apps, government i.d. apps, and Play, in favor of apps available on Accrescent, or obtained directly from developer web sites, or hand-built from GitHub, etc. (also an enhancement of GrapheneOS over the stock OS).