best is when you clearly maintain a KYCed front facing identity
and do all your shady stuff on separate infrastructure.
but who's got time for all that?
Discussion
GraphineOS with different logged in profiles isn't too bad, and also orbot with some apps routing through it, with others on clearnet. Orbit has this feature, choose apps, that routes any app through TOR. You just need to enable it properly in VPN mode:
on my graphene nonSIM phone I use Invizible instead of Orbot, which always gave me trouble
and I have a regular KYCed phone with a sim that i use for business and normie interaction
but then all my internet traffic goes out a VPN,
some of it to *another VPN...
although i mostly use tor bridges I'm sure theres some visible toe activity...
etc
on the whole, if the NSA was profiling me they'd wonder wtf I am up to.