Every user installed app and most of the app-based OS components run in the standard untrusted app sandbox. There is no way to install an app that's not sandboxed.
The 'tracker' detection in Exodus is simply detection for a list of libraries used by apps which they consider bad and marked as trackers. In most cases the claim is not really true. For example, a crash reporting library only reporting data after crashes is clearly not there as a tracker. Many apps make these features opt-in or at least opt-out, but they get marked as having a tracker for using the library regardless. Apps using these libraries do not have any additional capabilities. It has nothing to do with the app sandbox or permission model. It has nothing to do with which data you choose to give to an app or which permissions / access you choose to grant it. It is third party code used by the app which was put on a list of bad things by Exodus. If the app renamed the library / classes / manifest entries, it wouldn't be detected anymore. It will not detect anything custom or with decent obfuscation applied. It will only detect apps using a third party library they consider bad without making any real attempt at hiding it.
Play services being installed isn't particularly relevant to this. Play services on GrapheneOS is a regular app in the standard app sandbox. That's the whole point of the sandboxed Google Play approach. Having Google Play on GrapheneOS gives exactly zero additional access or capabilities to the Google libraries used by apps using Google Play. The whole point is that it runs in the same app sandbox. Every app can do exactly the same things as sandboxed Google Play whether or not it's installed. They can use the same Google services and other services.
Apps can use Google services without Google Play by using them directly. Google Maps is a great example of an app heavily using Google services without Google Play installed since it fully supports it and nearly all the features work fine without it with only a few things like compass calibration missing because they chose not to make an internal implementation. Google's libraries used by apps can have fallback code to use Google services without Google Play being available. Google's Ads SDK is an example of a library fully working without Google Play. Only the lite variant of the Ads SDK has a hard dependency on it since it leaves out the fallback code to make it leaner. The reason they don't do that in more cases is because they want to keep their libraries small and avoid depending on app developers updating the code.