CircusAround
You are making a big ado over nothing. Don't worry so much about the system apps! You are putting way too much energy into a purely imagined threat where nothing exists! The Phone app, the GrapheneOS dialer now has Nearby Devices Permissions! OH NO!!! WHATEVER WILL WE ALL DO! It sounds like you have a lot of paranoia combined with little technical expertise. A dangerous combination...
In reality, its not going to do anything scary with it. Don't like it? Revoke it! First thing after I flash a new factory image from my build of GrapheneOS, right after enabling memory tagging and disabling native code debugging for all apps, I then turn the sensors permission off by default for new apps. Then I go through all my user apps and revoke sensors permissions for every user app that don't explicitly need it for some functionality. That ends up leaving me with 3 or 4 user APKs, and all the system apps that still have sensors permissions. Why do I leave all permissions as they are with all system apps? It's because I trust the OS, GrapheneOS!
On the stock OS, there is the Carrier Services app, which gives your carrier system level access for your device. On GrapheneOS, they built a different system app to interface with the carrier, I don't know much about it, but I do know that it does not allow a carrier to remote lock your phone, or to set a seed in your persistent memory to prevent you factory resetting in recovery if they lock your phone due to an unpaid bill.
The GrapheneOS team is on your side. I do review the source code, as I'm getting to know GrapheneOS better through building it and rebuilding each new update. I am doing it very slowly though, as I look for ways to modify it subtly. It us very enlightening getting to know how things are done, learning the coding languages, and reading the comments in the source code, both for what is implemented and what is still planned! There's nothing worrying or malicious in there as of yet!