Is "sysadmin-ing" a phone really that big of a barrier? Ideally, you'd just install Mobian (i.e. Debian Mobile) on a device, security patches would install automatically via unattended-updates, and every two years you would be prompted to initiate a version upgrade. Proprietary apps would be available from Flatpak repos with strong sandboxing applied. That's essentially the same level of 'sysadmin-ing' any iOS/Android user has to do.