>  Turning on automatic software updates from Google would make me vulnerable to that threat. Using MicroG instead of Google Play Services would make me less vulnerable to that threat

The point is that you might know the people behind microG or trust them for any other reason, but not the people at Google