A last-gen refurbished pixel + GrapheneOS has been my go-to for years now. Gives me all the polished featured of flagship hardware with regular security updates and privacy.
Bonus points, the google play compatibility shim means you can run 99% of apps that are on the play store.
Just test the refurbished phone thoroughly on the stock os in case you need to swap it out.
Generally agreed, I would actually try using as many services with their progressive web apps.
The main reason I think they may need google services is the banking app. Mine will refuse to launch without google services installed.
You sound like the ideal candidate for a refurbished Pixel 7 / 8 from amazon.
Test its hardware thoroughly on the stock os in case you need to return it.
Install GrapheneOS using the Web installer.
Install Droid-ify into your main profile from the f-droid web page. It looks much better than the official f-droid client and actually has a working auto-update
Create a work profile. I use an app called Shelter as the work profile admin app. This allows you to auto freeze your big-tech apps to help with battery life / privacy. Install google services from the built-in GrapheneOS app store.
Enjoy.
I’ve been using Linode (now owned by Akamai) for a couple years now and have enjoyed their pricing / service.
You are correct, a VPN connection does not bridge to another profile. You can install a VPN in said work profile. The always-on VPN settings in grapheneos have the work icon to indicate what VPN is in your work profile.
IKR?? I feel personally targeted by this… And I’m OK with it.
I believe you can… I have google maps installed and disabled (frozen) by default in case I absolutely need to use it.