As others have mentioned GrapheneOS does give some control back to the user. You can set up contact scopes and file access scopes, you can remove the Internet permission as easily as any other permission.

Managing running apps is still a nightmare though.

I regularly go through the battery history of the previous night, to see if any apps were running while I slept.

So far I've, for example, found my banking app running something called a telemetry service, in the background, even if I set its battery profile to restricted. No way to stop that other than to uninstall the app.

GrapheneOS has one more feature that almost solves this called "Disable app". The downside is that it will remove the app from your home screen and it is a pain to re-enable it.

My current workaround is this:

I use a custom home screen shortcut app to create a shortcut to the settings page of the app I want to disable. Then each time I want to use it, I tap it on the home screen, tap "Enable", tap "Open" and after I'm done I tap "Disable" one more time and close the settings.

However now I've found a new culprit eating my battery. I use Google Meet through a browser, since the app won't work without Play Services. The browser I use for this is Brave. Now every time I leave a meeting, Brave will be listed as using most of my battery when idle. Nothing will remove it. Force stop, nope. Running services list, not listed. Only restarting the phone will stop it.

With all the rabbit holes I've gone through, I've only come out with one response to all this: "This is how Android is designed to work." so I'm not hopeful this will ever get better.