That’s overkill, with a rooted phone you can simply freeze (might be able to freeze it with ADB as well) or delete the Play store (it’s the Play Store where this Malware lives). GMS and Account Manager will work just fine without the Play store.

Or, like the other person said you can just disable Play Protect.

What about Think Shield? Found that next to Play protect in security settings

That’s the only component? If so, CalyxOS, GrapheneOS, LineageOS, and similar would be protected against this, since they have neither Play Services nor Play Protect. Am I correct in my understanding?

Is there any evidence that this will really remove Google’s ability to (a) see what’s on your phone, and (b) delete whatever they want?

Is GrapheneOS affected?