On my Google Pixel 3a, I can download AOSP to my own computer, modify it how I wish, scrape the vendor dependencies I need[1], compile it myself, sign it myself, and use my own key to control what OS gets installed, then relock the bootloader so it only trusts updates using my key! I can choose not to use Google Play and then install whatever App I want on it.
I wish I could not have to use any proprietaryy binaries, but this is as close to an open device that you can get today [2].
[1] This is where the quasi defense comes in. AOSP has no official process to install all of the vendor binaries needed to support carriers. If you don't include this process you get broken SMS, Calling, WiFi Calling. This script helps you do it: https://github.com/GrapheneOS/android-prepare-vendor
[2] Yes I know of the Librem 5. I am a day one backer and have yet to get a shipping notification despite shipping starting in Sept. I also know of the Pinephone, it is not publically available. I await the day those types of products are viable.