That's one of the main reasons why I use NixOS (for Windows non-FOSS apps too): the apps have no permissions to self-upgrade, only root can do that.

Mobile is more difficult, the easiest way: buy a Huawei without Google services