Sandboxing doesn't mean that every application lives in complete isolation from everything. It means basically that it doesn't have the ability to access data beyond what is available using the specified set of permissions.
In normal Android, certain components, google services in particular, exist OUTSIDE of the standard application sandbox and have access to far more data and control than their permissions would suggest -- they effectively have ROOT access. In GrapheneOS, a lot of work has been put in to force google services to operate within the standard "sandbox" just like any other user installed application. This doesn't mean that it can't communicate with other applications (especially those signed by the same key such as other google applications), it just means that it can't do scary stuff that you don't want it to do.
So if you sign in with a google account, then other google applications will share that still.