I really did a big job on my phone today.
Last night I discovered DivestOS, a fork of Lineage with some Graphene features but with one huge difference from the original: on some models you can re-lock the bootloader!
So I completely reset the phone, installed the OS, and reinstalled the various apps in the different profiles based on the different threat models I came up with.
I am really satisfied!