Giving a keyboard full access is essentially giving the developer permission to utilize system services like the internet, autocorrect, keystrokes, etc. Without this access Gboard is rather worthless. The information is being transmitted to Google so it's as safe as Google decides it's going to be.