I’d also like the ability to use sandboxed Google services.

That’s only a soft switch. A compromised device could turn them back on.