Ente looks interesting and worth looking into, thanks for mentioning it.

In the context of having a phone stolen, it's possible to at least limit the damage and revoke accesses via the Tailscale control server. Then the files on device are still vulnerable, but not everything in Immich (or whatever other service is running).