matchboxbananasynergy Sandboxed Google Play can be installed in any user profile, including the Owner profile.
In fact, features like eSIM activation require you to have Sandboxed Google Play on the Owner profile.
billbadger As Senor Matchboxbananasynergy said the Play Services can be installed ANYWHERE, many users decide such as myself to keep it in an isolated dedicated profile because I require to log in with my OG Google Account for Family purposes, such as to maintain the shared Family Library, Family Link etc, I also keep my banking app in there as well as some other things which allows me to keep it at rest before and after use fully encrypted and out of the way preventing unnecessary use or information flow succumbing to the sin of convenience.
Different strokes for different folks,
Options and freedom like that are reasons to love GrapheneOS and what sets it apart.