basically it only has the permissions you grant it (if you dont let it see location, it will bitch and not be able to locate you)
with lineage it is more of an on/off switch, if you flash Play Services it has all the permissions it wants. Graphene allows it to be more modular, or you could just put play services in a secondary profile (this annoyed me, I hated switching to use Play Services dependent stuff so now I'm just on the stock Google OS).
