> but I'd love a more solid answer

Unfortunately that isn't a question you'll get an answer to. Anyone who actually knows and has access to sensitive sources and methods is under an obligation not to disclose them. Further nobody in the know wants to burn these sources - because it makes their job harder.

The general advice I can give is use an iPhone (turn on Lock Down mode if you believe you might be the target of well resourced attackers), use Google suite for your personal data (and turn on Advanced Protection), don't use commercially available VPNs (set up your own or just don't connect to wifi in untrusted places), and periodically delete third party apps you don't use (especially any that use location services).