I'm not going to debate the conclusion of this paper, but keep in mind if you pick Android, it's still very important to pick the brand correctly. When you open the Clock app on Xiaomi phones, the first thing you see is a privacy policy you need to accept (!). Samsung might be better on this. I saw quite a few people on other websites (not HN) who said they switched to Android after Apple's CSAM thing, but put little thought into brand choice beyond price and features, just assuming all Androids are the same.

You might say that people who really care about privacy would just get GrapheneOS, but the mainstream info available to help make these decisions is really poor as of now. Just seems like a Wild West.