I have no idea, but I guess it doesn't really matter. If you start sending massive amounts of spam through gmail, does it matter if you did it after logging into the site with your user/password or through oauth api access or through smtp?
Well, as an app store, it pretty much has complete access to your degoogled phone, but (until recently) it defaulted to a pool of shared google burner accounts that were only used to download software.