Anyway, for my parents' old phone I built one simply QR Reader without any crap. If you need one -> https://play.google.com/store/apps/details?id=com.prof18.sec...
While Google will not start any overly obnoxious ad-serving, who tells you they will not upload all or a bit more stealthily some pictures for some AI user profiling thingie? Cannot happen? They collected WiFi access points when doing Streetview back when their motto was "Don't be evil".
As for the second part, that's your personal risk tolerance so I'm going to leave that to you. Google is generally a high-trust brand in America, so most people will find the risk tolerable. If you don't find it tolerable, you shouldn't use it.
Sure, nobody doubts that. Whether the trust is deserved, that's another story.
They scan your email to find out where you traveled and what you bought. I guess most people don't know and many are shocked once they find out.