Sandboxed Google Play makes it so Play Services and Store are sandboxed the same way as other apps.
All apps have ways of seeing what other apps you have installed in the same profile, and of course, they'll know about which apps you've installed regardless of that, if you installed them through their store.
Furthermore, there are SDKs that apps can use specifically to trigger a prompt to rate the app, which may be what's happening here.
I would recommend giving this section of the Features page a read, as it might help you better understand how the Sandboxed Google Play feature works:
There is no special sandbox for Play Services and Store. They are sandboxed the exact same way as all other apps you install on your device and play by the same rules. What GrapheneOS does is teach these apps how to play nice while being confined the the standard app sandbox.
If Play Services and Store can do something on GrapheneOS, so can other apps.
I hope that helps!