Use a Pixel phone running version of GrapheneOS built and signed by you with your own keys, or use stock GrapheneOS and don't lock the bootloader, and add root access if desired.

That's the only hardware/software system that guarantees both total freedom, support for mainstream apps, good security and a quality device.