Pixels are (currently) the only phones that allow for all of the following at once:

• Proper verified boot
• Bootloader unlocking (this is most important for any custom ROM installation, regardless of ROM)
• Hardware memory tagging
• Full hardware isolation
• Hardware key attestation
• Ability to disable USB data (and also USB entirely) at the hardware level
• Everything else on this list

In short, it's simply because Pixel currently has the most hardware level security features of any Android phone (on top of bootloader unlocking), for now. The Graphene team is allegedly in talks with an OEM to produce a phone specifically designed for it, which may be just as or even more secure. Time will tell.

I feel the need to mention that I'm not trying to shill for Graphene and especially not Google. Depending on your threat model and goal, Lineage or similar might be just fine for you. I just don't think there's anything more secure than GOS at the moment, and if that is important to you, along with minimizing bloat, it's a great choice. I do highly recommend avoiding root and instead just get something that you can unlock the bootloader for, and then install a degoogled ROM. Just make sure you don't accidentally buy a permanently locked phone, make sure it says unlocked somewhere in the listing.

I'm sure its in the link the other comment provided, but I'll call out that you not only can unlock your bootloader to install your OS but you can relock it so nothing can install anything afterwards.

So if your phone is ever not in your possession you can be sure that nobody installed anything. Also keeps your phone safe from malware (at root level).

There ya go, Murena is probably your best bet.

Looks like they have a few devices, actually

https://murena.com/products/smartphones/

Android does not have the same security model as desktop Linux. I made a comment about this above (which you probably can't see due to .world being defederated with who I replied to), but if you don't want to go to my comment history, it's summed up as three or so main issues.

Rooting breaks OTA updates since it modifies your partition hash, meaning rooted users tend to leave security holes open way too long. Android does not have a package manager for you to be able to update these issues individually.

Android does not expect users to have root access, so they do not even consider it in the design. Android sandboxes apps, and apps can only generally have permissions that you grant, with no direct access to the kernel. However, rooting adds an entirely new attack surface for which there are no protections whatsoever. Desktop Linux, on the other hand, does expect users to need root level access from time to time. That's what sudo is for, but you should not confuse this with switching your user entirely to root and doing everything as root. There's a reason that's not recommended on Linux: it's dangerous. The same thing applies to Android. On top of that, Linux has other tools and protections designed to make running as sudoer safer, and Android has none.

Finally, it breaks your ability to use proper verified boot. If your system partions silently get malware installed, there's generally no way for a user with a rooted phone to notice. Verified boot protects against this, but because rooting (along with whatever else you're running as root) changes your partition hashes, it will either stop booting or revert your changes.

If mobile Linux ever takes off, it will likely be very similar to desktop Linux and be designed with root in mind.

Wdym until February?

OnePlus originally had really nice enthusiast features and support for the CyanogenMod ROM. Now it's just another manufacturer of corporate-safe glass-and-metal slabs while the soul of CyanogenMod lives on in LineageOS.

Carl Pei left OnePlus and put together Nothing. Nothing is a bit closer to what OnePlus was supposed to be, but they still leave much to be desired. They went all the way to implement a detachable back on the CMF phone, but the battery is still sealed inside. Absolutely no advantage compared to manufacturers like Google in terms of the third-party ROM experience.

FairPhone is the best of the bunch, but their priorities don't necessarily match those of the community (i.e. security concerns, loss of audio jack and USB 3.0 on the FP6)

I don’t have one, but I think they are overpriced for the specs you get.

Their goal is sustainability, but the outdated specs means I’d probably upgrade more frequently than I would with an iPhone where I can upgrade less often.

Didn’t say it was. I said that was the idea behind them. I’ve never used a phone from any of those three.

I'm sure it's a good value for some. I just use the super budget phones. They work fine and have more stats than I ever need.

no headphone jack, no SD slot, comes with /e/OS.

• I personally didn't need jack but I understand it might be problematic for some. If you create music for example you might not want the latency but for that I have a dedicated PBG-1 (OSHW grove box) which does have jack. FWIW there are USB-jack adapters.
• it has an SD slot, I have a .5To inside
• comes with /e/OS was the point for me. I wanted a deGoogle Android without any tinkering. If you don't want that though you can buy straight from CMF but I don't know with what ROM they will ship.

In the end any mobile phone is inherently privacy invasive because of tracking by the cellular carrier, and the unending security bugs in the software. It’s hard to do much about this.

• if you don't trust cellular carriers you can setup your own network, e.g. https://www.crowdsupply.com/ukama/ukama but... yeah that's a bit demanding and obviously nobody else will connect to it. You can use eSIM but still have to trust the resulting carrier. You can rely on WiFi only but same, trust the ISP or encrypt everything you can, have your own VPN elsewhere and hope you can go through deep pack inspection
• on bugs in software... but I like https://www.crowdsupply.com/sutajio-kosagi/precursor is exploring the idea, pragmatically, of verifying the whole stack, hardware included, but it doesn't go to mobile packed. One could consider this with simpler modem equivalent, e.g. LoraWAN, but with the obvious bandwidth limitation. None of that removes bugs but if the entire stack is verifiable at least it's about genuine bug, not backdoors.

A headphone jack is just another attack vector! Use your head!!!