The smart speakers are a privacy nightmare, but on your phone, random apps cannot access your microphone without your knowledge or control, excluding straight up malware. There's a million anecdotes like yours on social media and none of them have held up to rigorous testing.

The fact is, most people don't realize how much of their thoughts one way or another are reflected in their digital lives, nor how good google's algorithms are. And there's also things like the frequency illusion etc.

Unlike other ROMs like CalyxOS, GrapheneOS ships the actual Google Play services and Google Services Framework, but they're sandboxed so they can't spy on you. Whether your banking app works, depends on the SafetyNet requirement it has. If it requires full integrity, it unfortunately won't work on any system that is not whitelisted by Google. If basic SafetyNet integrity is enough for the app, it will work on GrapheneOS. You can google (or duckduckgo) your banks name and "GrapheneOS", and you may find posts by other people who tried it out.

Edit regarding software in general: When you install Sandboxed Play Services, you also get the Play Store which you can use to install apps. You can also use the Aurora Store, an anonymous front-end for the Play Store. There is also F-Droid, which offers FOSS alternatives to most applications.

Edit 2: I found this post over on PrivSec which has a list of apps and details on whether they work