If you want full freedom / maximal privacy, and are prepared to make compromises on capabilities and battery life, look at one of the Linux-based, non-Android options. I've heard of quite a few bugs with these.

Most of them also have really bad security, for various reasons, including:

- Since virtually no hardware vendor (outside Jolla) supports non-Android phones, they typically use phones that were made by their ODMs as Android phones and rely on kernel/firmware/device trees made available for those Android builds. Sadly, nobody outside Google (PixelOS) and Samsung really cares about giving their kernels and firmware timely updates. So usually the kernel and firmware are full of known holes (Qualcomm and others do monthly bulletins).

- For many reasons, Linux systems have never really focused on proper security isolation and sandboxing. So most of these phones have really poor isolation and you are only one browser/image parsing/... vulnerability away from full phone compromise.

- Unlocked bootloaders or otherwise compromised boot chain. So, it's easy for persistent malware to compromise a phone and there is no way to attest that the system runs unmodified binaries (as you can e.g. can with GrapheneOS' auditor or Android phones with fully verified boot and Strongbox).

Let's say, if I was a bank, I can understand why I would want to block such devices.