Both ship:
Firmware, the HAL components (which are way more critical in my eyes as they have low level hardware access and could hide anything from the OS)
Example for these are: The Camera Stack, the Audio Stack, under Graphene the Widevine DRM components.
Sailfish can run without these, e.g. on the Pinephone. Graphene OS can't
Graphene additionally comes with an eSIM binary, which is disabled by default
Sailfish comes with proprietary UI components, a choice the company made because of their limited manpower as it allowed them to provide features where currently no open source solution exists or existed at the time of implementation) examples are swipe gestures for the keyboard, MS Exchange support, Android App support.
That not great, but far from a closed source system where everything is closed source. There exist many patches for UI components because they are partly open source.
The OS ist still Linux, that is true. It is even LInux+GNU which Android is not. It is Linux with closed source components, thats true too.