Let's say that I'm on the latest Pixel device with the latest GrapheneOS release.
I have configured GrapheneOS settings for the best security.
I obtain modded APKs from reputable sources.
I scan APKs with VirusTotal (I know that badness enumeration doesn't work, but it doesn't hurt too).
I try to limit permissions as much as possible.
What are the chances of these modded apps doing some real harm?