Good point and thanks for the heads up.

Mostly asking it as a question, given that graphene runs Google play services (optionally) as a normal, sandboxed service with no special permissions might help a bit, but I guess unless you disable networking for every other service installed, this is sort of impossible to plug 100%? IPC can be quite the security hole.

Yep, nothing has changed yet. GOS project still has this in the road map, but as of now Inter Profile Sharing still works.

Agreed.