I’ve successfully debloated two googled ROMs before, once in stock and the other on a custom ROM with GApps prebuilt, and while you can debloat major parts like Google play and Google services, minor parts cause annoying crashes and functionality loss if you debloated it to get a full degoogled ROM, at that point , using a Vanilla ROM is better

It depends on how you use your phone and what the physical attacker aims

• if you use a custom ROM with decrypted /data partition by default and no way to encrypt it, the attacker can get access to all of your data from recovery even if you’ve set a lock (like password/PIN/pattern) in the ROM, but if your custom ROM is encrypted and protected with a lock, the attacker must know your password to decrypt /data partition in recovery
• if the attacker aims to replace a part of your phone with a sus one (like a boot partition for example), he must be a developer who knows how to build things designed for your exact phone model, otherwise your phone will get bricked
• if your phone is rooted and you give root permission to sus modules and apps, it’s possible to install malware and do shady things in it without physical access

My recommendations:

• only use trusted ROMs
• only use an encrypted ROM ( official LineageOS is encrypted if I’m not wrong) , encrypted ROMs are slightly slower than unencrypted ones, but safer
• set a lock to the ROM
• avoid giving ROOT access to untrusted modules and apps
• (if you’re paranoid) clean flash every time you update or switch ROMs, as this will replace any sus partition flashed by an attacker
• (if you’re using decrypted ROM and custom recovery) set a password to the recovery, BUT if it’s orangefox make sure to remove the password before updating the recovery, otherwise you’ll get troubles

And Vanilla ROMs users

Not privacy focused compared to other options, it’s more for those who want customization options

Kiwi is buggy and there are better options for privacy

Mulch or Cromite

Surprisingly, I thought about the same thing a few days ago … but we have mull browser

I tried it many times but it consumed more data & resources than brave

Brave … nothing else suits my needs

Indeed I have never bought something online

Does Sony still make phones ? … The last time I saw someone using a Sony phone was probably 8 years ago