K8y My only concern is having Google Pixel stock camera app now (which is a bit sharper) on my profile, but I hope its accesses are much more restricted in grapheneOS. The idea of stock cameras being remotely turned on, or the app seeing my photos, really bothers me.
If one believes a specific app plausibly is malicious, it is not prudent to run it on a device one wishes to be secure. Serious malware researchers do not deliberately run malware on devices holding their family photos, e-mail, whatever, and in fact do not deliberately run malware on their regular infrastructure (home network, personal SIM card, etc.).
At some point one needs to choose which is more likely: either Pixel Camera is a legitimate camera app written by a large company which values its public reputation (that's my guess), or Pixel Camera deliberately contains code for being remotely activated to spy on users (I seriously doubt it).
If one believes the second scenario is likely and one is serious about security and privacy then it is difficult to see how "sharper" pictures would justify accepting malware onto any device with important content.
Personally I would be shocked if Pixel Camera contained malicious remote-activation code. Of course it's technically possible, but lots of nightmare scenarios are technically possible. To live in the world it is necessary to rank hypothetical threats and to press on despite the theoretical existence of implausible hypotheticals.