When it comes to Android security and hardening, sources like the TOR project recommend to avoid the installation of Google Play Services (I'll call them only "the services" here). I'm aware that the following things could happen when the services are running:
Google could add any malicious code at any time when I have internet access.
Google could be forced to do so or somebody could exploit their infrastructure.
The services could already contain malicious code by someone for some reason.
There are vulnerabilities which could allow elevation of privileges and such.
But there are some problems with all these possibilities:
There's no proof that something like this ever happened before (except the vulnerabilities. nobody could seriously deny that such a large codebase has vulnerabilities).
They would require a targeted attack.
It all (still) sounds like conspiracy theory for many (even technical) people.
So my question is: What can Google actually do on my phone which will breach my privacy using the services without any patching and exploits? Can they access private app data? Record keystrokes? See network communication? Manipulate what I see?