From what I understand, when building an OS like GrapheneOS from AOSP, a first-party app store is required. The INSTALL_PACKAGES is required for the first-party app store to be able to install apps directly. It is a permission that can be given to that one app only. On GrapheneOS, Apps is the first-party app store.
Third-party app stores can use the ACTION_VIEW or ACTION_INSTALL_PACKAGE Intent, but you would need to enable the "unknown sources" toggle for them.
For further details refer to:
https://developer.android.com/reference/android/Manifest.permission
EDIT: The permission can be given to more than one system app.