I responded elsewhere, but to summarize:

Use an iPhone, minimize my use of it. Continue to emphasize Linux on all my other devices. Move away from Google and Apple services to as much self-hosting as possible. Leverage TailScale to make my services accessible, globally, without actually exposing them on the internet. I'm just assuming that I will have to have some kind of attested device in order to run banking and payment apps and that might as well be a locked down device like an iPhone.

An unofficial build of Android, like Grapheneos. It likely won't be able to install apps from the Play Store, but at that point it might be a blessing.