Comment by grapheneos

microG uses many of the same closed source Google services, downloads and runs closed source Google Play binaries with Google access and exists to provide compatibility with closed source Google libraries used by apps. Using microG doesn't change that you're using closed source Google code on the client side and also on the server side for many of the services. It also still uses closed source Google Play code itself, including downloading and running droidguard which is highly obfuscated and dynamically changes on a regular basis. That code gets access to all the permissions and privileged access being given to microG including the Location permission and all the special privileged app access which is doesn't get when a user installs sandboxed Google Play on GrapheneOS.

microG has a poor privacy and security track record. They've repeatedly had severe privacy and security issues which are publicly discovered and then go unfixed for years. One of those which involved leaking location data to apps which weren't supposed to have access to it was documented on their wiki but yet not addressed for years. There are still privacy holes in the location implementation, although the most severe issue was fixed.

GrapheneOS does provide open source reimplementations of Google Play APIs including location. It provides those as OS libraries running in the apps using them instead of an extra service. That means location data access is restricted by the standard sandbox and permission model rather than needing to reimplement it in a service. Reimplementing it in a service means mistakes or failure to keep up with the modern permission model can create privacy holes, which has happened with the microG location service repeatedly and taken years to address.