At some point Samsung started locking down their bootloaders I think. Device support is based on whether/how many people volunteer to own that branch, so it's based on general demand. Last I checked OnePlus made the best Lineage devices, although with all the recent China stuff you can decide whether you're comfortable with having even firmware from a Chinese company.
I don't know about the DNS, but Gapps don't come preinstalled, so I'd be surprised if it sent telemetry to Google by default. Either way, I'm sure it's possible to disable/redirect those things.
As for privacy in general, they offer a pretty unique feature that allows you to forcibly block granular app permissions after the fact, after granting them for the install. Because this isn't iOS it'll break some apps that don't handle it gracefully, but it's nice to have the option.
But yes, if you're trying to run Android in a privacy-minded way at all, you'll be making some sacrifices.