To be honest I don't understand how this works e.g. even with LineageOS' PrivacyGuard I still see some background processes in cache that had no permission to run on boot.

But it's absolutely necessary. I can't upgrade until I have that. I want full control of what runs on startup and what should be allowed to keep running on background (manually closed by me, I'm not asking for a skynet AI to guess).

Another one is blocking internet access but that will never happen because of their business model and ads. I guess I'll have to risk my personal data by using an open source firewall (not like I'm not going to review all the code) and unlocking bootloader/root.

Android is a disgrace because of these "small" things that they refuse to fix. But I'm glad it's slowly getting better.

This is largely due to a limitation of Android itself. If your app wants to do any sort of background task that's not tied to Google Cloud Messaging, it needs to setup those background tasks. When your phone reboots, those tasks are cleared. Many apps use the "run at startup" permission to receive a notification from the system when startup has completed. It doesn't actually mean the app is running in the background.

You have - it's in the apps' settings screen called "Allow background activity".