Of all the platforms in existence, GOS is probably one of the safest ones on which to do things like this (running isolated VMs being the other). AOSP has itself very strong sandboxing for apps, GOS significantly hardens various aspects of the OS, and using a separate profile provides further isolation.
All that said, you're still installing known malware on your device, which presumably contains sensitive personal information. That's pretty much always a Bad Idea™. All software has security bugs; just look at how many Android CVEs get issued every month and consider that every so often there's one that impacts sandboxing or provides a link in a chain for an app to break out.
Realistically, these pirated APKs are probably not engineered by extremely sophisticated engineers taking advantage of zero-days and "one-days." Most of them probably do obvious stuff like try to get accessibility permissions or "display over" permissions and that sort of thing to steal credentials.
Still, if it were me, I'd do this on a physically separate device that I never connect to my primary LAN. It's hard to answer, because nobody here knows your personal risk tolerance.