It is not controllable at all: It still enforces any app author's will against the user's. Root is not offered, and the grapheneos maintainer seems to be personally offended by the thought that root could be helpful.
I'm not sure what you mean by this. All apps run in a sandbox and you can deny permissions if you like.
>Root is not offered
Root access on Android is a security hole.