If you are a nobody, there isn't a need to pay for the "latest and greatest". Security updates are a meme and just a way to add more bloat. Don't download apk's from unknown sources, use an adblocker and that's 99% of all attack vectors closed.
That only leaves pre-installed bloatware, a legitimate issue that can be solved with a few steps. The phone doesn't matter but get something android 10 or higher, their selective permissions are nice but you can go as low as android 6 without too many issues. But you might have app compatibility problems.
During phone setup, don't immediately connect to the internet.
If you can uninstall the apps do that. Otherwise, force stop and clear data of every installed app that you don't think you will ever use. As long as the apps don't open or take up ram or cpu cycles then the phone is functionally 'bloat free'
Remove all of the permissions that don't make sense. Your calendar doesn't need access to your microphone or even contacts.
Turn off all settings that even hint at telemetry including locations.
Once this is done, you can connect to the internet. Download fdroid through the browser and look for a local VPN that is capable of blocking access to apps and has a decent permissions menu. Get that configured and then you are good to go. The local vpn will almost certainly break things the first time you use it. But you can just tweak it and as long as you aren't installing any new apps very often you won't have any problems. Stick with open source apps as much as you can.
And only update Apps when they break or if there is a feature you really want. Don't actually do anything important on your phone like banking but if you have a browser with adblock then that's fine but keep it minimal.
I like this method because it's phone agnostic. I don't have to settle for a pixel or another phone that I need to get root on. If this sounds like too much and you don't want to flash a new OS, then just get an iphone.