Ok so just don’t do banking and critical communication on a cellular device with mysterious CPUs. What’s your threat model? I like to use a flip phone and just don’t do anything important on it.

What non Chinese manufacture are you looking at? I liked Xperia I for being made in Japan but it’s still Chinese components underneath and as you say there’s no control of all the code.

There’s always Bunnie’s Precursor phone if anyone is interested in commercially developing something reasonably secure and auditable.

I probably trust banking the most on a locked-down phone. It is in fact the interests of the state and its monetary system that these systems that implement it are secure.

At the same time, the state has its flaws and I'm questioning whether a top down system can ever really work, not out of some kind of "fuck the man" point of view, but more of an engineering and systems design perspective. If the system is perfectly factored, there are no cross-cutting concerns. But in such a system there is no need to communicate or coordinate laterally, only up and down. This sounds very lonely.

And if this system has a flaw, not a specific flaw, but rather a flaw in the assumption that tree structures with abstraction are a good way to organize systems, it might be impossible to change from let's say a tree with a single root to multiple interacting trees, with multiple roots of authority. Or maybe this is possible if people can learn to exist in multiple seemingly incompatible realities simultaneously?

Why have a compromised phone at all? You're still exposing yourself to telemetry. And if you've ever said anything positive about a Hong Kong democracy activist, you still have to wonder what's going to happen to you if you travel to any country with a mature extradition relationship to China.

I also think it's easy to underestimate your footprint when it comes to ecosystems that involve money in any capacity. No Amazon, Steam, no card information on a Netflix app, no signing in to Google to read a NYT article.

I think either you care about these things categorically or you don't, and I don't think anybody is going to be in the middle space you seem to be envisioning, which is concerned enough about the risks to avoid all banking but still a casual enough attitude about a compromised phone that you're fine with it for uses you consider non-secure.