Enough? That's hard to say.
Every SAP system, whether GRC or anything else, requires Basis input. Pretty much by definition, then, theree's more Basis-level work than GRC work. As Gretchen said, there are complications from on-premise/cloud/outsourcing arrangements, but still I'd be surprised if there wasn't a lot more Basis work overall.
If you are talking about GRC rather than simply ERP security, I'd say the skill sets are quite different. I've done both, but I don't know many others who have. GRC requires much more of a functional and audit mindset.
Steve.