polymer_wildcat Personally, i'd rather risk [breaking something], than give my system Contacts app a network permission...as long as i know exactly what those permissions are doing. Least privilege OPSEC paradigm exists for a reason.
Unfortunately i can't read code, hence asking devs, since GrapgeneOS team working on improving / hardening those apps must know for sure.
The GrapheneOS developers have shipped these apps with these permissions, based on their evaluation process. To my eyes this request contains a bit of a contradiction. On the one hand, anybody can choose where to place trust, so one might not choose to trust those apps merely because the GrapheneOS team does. But on the other hand, if one's application of "opsec" doesn't allow trusting those apps based on the GrapheneOS team's trust... does it make sense to ask the GrapheneOS team for further assurances? Note that the team ships large amounts of privileged kernel code, library code, system services, etc., that is not limited by app permissions.
One option might be learning to read some code to some extent. Another option might be hiring somebody who already knows how to read Android app code to report what sort of risk might be posed by those apps having those permissions -- or to look into possible vulnerabilities in other parts of the system, which might be more dangerous.