That's the only component? If so, CalyxOS, GrapheneOS, LineageOS, and similar would be protected against this, since they have neither Play Services nor Play Protect. Am I correct in my understanding?

Is there any evidence that this will really remove Google's ability to (a) see what's on your phone, and (b) delete whatever they want?

What about Think Shield? Found that next to Play protect in security settings

That's overkill, with a rooted phone you can simply freeze (might be able to freeze it with ADB as well) or delete the Play store (it's the Play Store where this Malware lives). GMS and Account Manager will work just fine without the Play store.

Or, like the other person said you can just disable Play Protect.

Is GrapheneOS affected?

This but unironicaly.

Sent from my Android phone

I just wish theu finalky fixed it, the rate limiting is really damn annoying by now! I started to sideload apps from apkpure and update them with Aurora to keep my anonymous user account but it can't take long till that's gone too I guess! :(