As I think you have alluded to, it's rumoured to be done through Google Play Services not via the OS. No Google Play Services, no problem is my understanding.
Luckily we have options, GrapheneOS, Cal...
The authentication mechanism is linked to android ecosystem itself. Graphene cant get around this mechanism im talking about. What google is trying to do is force update all devices with the code to run apks and android apps. Graphene will boot but wont be able to open any apps without this authenticator, im not sure how they plan to make apps work offline but what im talking about Graphene wont have a legal fix to.