AFAIK, Mailbox.org was once open source, but has not very recently become closed source. PrivacyGuides.org recommends it, as does Tresorit (encrypted cloud storage), for example, which is closed source and is one of the services I use. Providers that implement encryption, have been audited, have been on the market for years, and have a clean track record of security or privacy scandals, which there aren't many of these types of services these days. But I personally don't like them and try my best to avoid closed source softwares as well.
In conclusion, PrivacyGuides mostly recommends open source software but also recommends some that are not based on their features, reputation, security and maturity.
Regarding the implementation of GrapheneOS's Google Play Services sandbox, I particularly like it and if it is to be considered something to popularize the use of open source OS (GrapheneOS), limiting Google's data collection (since the use of Google Play Services sandbox is completely opt-in), it also maintains compatibility and avoids many issues so as not to alienate the general public from enjoying the other benefits of using an open source OS, something that MicroG does not do, however, I use it and I think it is an incredible project, but take into account the perspective of popularizing open source by the general public without associating it with software issues.
That is why, when I refer to understanding the purpose of the CalyxOS project, I really understand, what I mean is that there is no prospect of changing and becoming a more hardened Custom ROM benefiting its users. A lot of things could be improved. There are resources for that.
NOTE: I know about the end of the Divested Project development, which is worthy of applause for the time of contribution to the community and of thanks without a doubt. I only used it as an example of a truly hardened Custom ROM and that should be the goal for those who say that their OS is suitable for journalists like the CalyxOS team.