...assuming you are connected all the time, or at least that the services are running all the time. In my case they are not. I only enable them every once in a while, when I need to be alerted of something. This might not be how most people use their phones, but I do it because there is no way to preserve any privacy at all if you are running Google services 24/7 (sandboxed or not).
I see Google services as malicious software - not security malicious (Google can't risk that) but privacy malicious. This is why I care more about ability to turn them on / off than about what kind of access they have. Even inside the sandbox, as regular apps, they have way too much info about me.
As I said: I would prefer sandoxed MicroG, but given the available options non-sandboxed MicroG is preferable to sandboxed always-on Google services.