Micro g is still downloads Google proprietary blobs and runs those. So it is not open source so much as it's an open source launcher of Google's proprietary software. It's an interesting improvement, but it does not a panacea it does not fix the issues
Are you sure? I thought that what you describe is what packages suck as NikGapps did, while MicroG is a reimplementation of the code. It does call Google webservers, but it doesn't run Google's blobs (which is also why it's severely limited/fragile compared to packages that run them)
MicroG reverse engineered,
and re-written as much as possible from GApps libraries, from the ground up, as open source software.
These re-implementations are as light weight and privacy respecting as possible on your local device,
however the same does not count for the Google servers it communicates with (if you choose to enable them).
For SafetyNet attestation, a proprietary, isolated, DroidGuard blob is downloaded (if you choose to enable it).
I see the graphene OS community says micro g downloads binaries from Google.
I did a couple minutes of looking at the micro g website, and the wiki, and I don't see anything that says they aren't downloading extra components from Google. So I'm not sure.
....
It seems I was confusing OpenG apps, which does download proprietary bits, and micro g which apparently does not download proprietary bits
The thing that comes with lineage OS by default is OpenG apps.