dsdx331 I would assume that's a design decision by AOSP. Not sure how it works, but the list could easily be cached, or maybe the launcher app has an added permission to get the list of installed apps. Either way, I don't think this would be a "leak" since installed apps are still inaccessible to other apps.
I can't speak for the project's developers, but they may consider changing this behavior. You can suggest such a change here: https://github.com/GrapheneOS/os-issue-tracker/issues. You may want to search quickly if this has already been suggested beforehand. I did, but didn't see anything, but I may have missed an existing issue.