If you're going to do this, buy a Pixel so you can have the bare minimum in secure hardware.
And consider GrapheneOS.
And consider GrapheneOS.
Other Android phones often either have broken verified boot implementations (such as only verifying the kernel) or completely lack it.
The Titan M makes Pixels even better; it is a security chip which stores keys such as those for verified boot.
The security of Pixels is why security-focused mobile operating systems like GrapheneOS often target Pixels instead of say, Samsung Galaxies.
Anyway, please read GrapheneOS.org in its entirety.