The microG creator goes into more detail about signature spoofing at https://github.com/microg/GmsCore/issues/1467#issuecomment-8...

The concerns usually raised against that are due to the "default" patch included in their repository, which has a specific purpose.

We don't use that, https://calyxos.org/about/tech/microg/ are the precautions we take to try and prevent abuse.

I made it a privileged permission because that's a standard Android thing to gate things (such as reading of IMEI) - My thought process being that if you somehow managed to get around privileged permissions, we have much bigger problems than signature spoofing.