Yeah. I've been using it for years.

GrapheneOS prefers using sandboxed Google Play instead for security and functionality reasons, but they are pretty obscure. In theory, microG could be used to install a malicious app with elevated permissions, since it has the ability to bypass security checks. If you trust the apps you install, then it's a non-issue. It's potentially less functional as an open-source implementation, since it is not a perfect 1 to 1 replacement of Google services. You may find that there are certain functions it just can't do. I don't know of any specific examples.