There's no 100% security.

Even GrapheneOS runs as a VM client and can be compromised by gov/fone service providers by attacking your closed source hardware driver of your GSM/Wifi module.