eos-metrics is going to be a hard dependency because it provides a small API for applications to use without having to interact directly with D-Bus. However, eos-event-recorder-daemon – the component that actually submits metrics – is not a hard dependency, so it will be pulled in only via comps and users can uninstall it if desired, like you suggest. The flow is: application uses eos-metrics → sends metrics over D-Bus to eos-event-recorder-daemon (or not, if it’s not enabled) → eos-event-recorder-daemon submits metrics to Fedora server via HTTPS
Then eos-metrics-instrumentation (the service that submits generic metrics that are not provided by particular applications) will also be optional and pulled in via comps, so you can uninstall that too.
Uninstalling is not necessary to disable the system, but is good to do if you’re paranoid.