1 Yes, I trust them more than Google
1A It's very little, mostly down to updates, network check, sntp, ect

2 Yes, he has been a prick at times but he's never done anything malicious
2A The code is open, if there was malicious code we'd know
2B He's contributed code to AOSP, so you're trusting Micay regardless
2C He stepped down from the leader of Graphene. I think the swatting put him in a bad place and I won't defend his actions but his actions are fairly irrelevant in evaluating the project 

 It is not so much about malicious code it's about information they gather about you.
You never know when it can be used and by whom.

">     Mozilla has a history of harming me. I've documented this as one more
>     case of attacks from Mozilla to go along with everything else. I see
>     no reason to put up with it or tolerate it. Mozilla should expect that
>     one day they're going to be held accountable."

https://lists.torproject.org/pipermail/tor-dev/2019-August/013995.html