I can understand that some people find the claim that Aurora offers no privacy benefit over Play Store to be counterintuitive. Lots of online privacy communities recommend avoiding Google as much as possible, and my overall impression is that those communities still recommend that people use Aurora instead. Being used to hearing that Play Store must be avoided at nearly all costs in order to "deGoogle" as much as possible, it's understandably a surprise for people who come to the GrapheneOS community to suddenly hear that Aurora must be avoided and Play Store should be used instead.
But the claim that Aurora offers no privacy benefit over Play Store is true, if the apps you download contain Google proprietary blobs, which a lot of them do. They can collect the same amount of information from your device as Sandboxed Play Store and Services can.
https://xcancel.com/GrapheneOS/status/1870213347188129811#m
Aurora Store is simply a way to obtain apps from the Play Store. Those apps still come from the Play Store and are still APKs generated/signed by the Play Store which often include the Google Play SDK / libraries. You are not actually avoiding Google Play by using Aurora Store.
But there is genuinely a security cost to using Aurora instead of Sandboxed Play: https://xcancel.com/GrapheneOS/status/1832861969851814268#m
Aurora Store doesn't verify the packages it downloads came from the Play Store via either the signed metadata in the APK or another way. That means it's only secured with WebPKI TLS without enforced Certificate Transparency, which is really not good enough for package downloads.
In practice, that means that there is a risk that an app you install from Aurora could turn out to not be the genuine app.
By the way, you can create a Google account without providing a phone number in this way: https://listed.to/p/vznkmwrV5w
If you want to minimize the amount of data that Google collects about you, it seems pretty clear that you'll have to avoid all apps that contain Google proprietary blobs. In practice, that might imply using only open source apps that can be verified to not send any data to Google.
https://xcancel.com/GrapheneOS/status/1810304517927231527#m
If you want to avoid the Play Store, then you're going to have to avoid Aurora store too.
We aren't going to endorse installing apps from the Play Store in a way that's less secure than getting an APK with a browser. We've always been against performative privacy/security...
When users who are new to GrapheneOS ask questions about Aurora, I find that some users in this community tend to simply state that Aurora is a security and privacy risk but without providing any sources or details. But new users who are used to seeing Aurora being recommended understandably want more details. When sources and details are not provided, I'm not surprised to see them express confusion or frustration.
On the other hand, it's understandable that community members are tired of repeatedly explaining the risks of using Aurora, since it's so often brought up in this forum. Perhaps members who have knowledge on the subject could compile an article on it, which could be referenced whenever the topic is brought up.