I also think it's easy to underestimate your footprint when it comes to ecosystems that involve money in any capacity. No Amazon, Steam, no card information on a Netflix app, no signing in to Google to read a NYT article.
I think either you care about these things categorically or you don't, and I don't think anybody is going to be in the middle space you seem to be envisioning, which is concerned enough about the risks to avoid all banking but still a casual enough attitude about a compromised phone that you're fine with it for uses you consider non-secure.
The major problem is banking, although some banks still work with Waydroid, and a few banks have full featured websites that work. But you do have to be more selective.
Is a browser on compromised hardware supposed to be more secure than an app? Amazon, steam etc still risk exposing accounts authorized to make payments using your money. It's easy to think "I just won't use banks" and underestimate the risks of doing anything on compromised hardware, and the answer isn't to play the "what could possibly go wrong" game, it's to not use compromised hardware.
I’m not really worried about mainstream Chinese manufacturers stealing my bank credentials. Fly-by-night budget phones full of crapware, yeah sure.