Security is not a state but a scale, and is gauged against everything else.

From the perspective of a privacy / security zealot, a smartphone is SOL as soon as they lave the factory, as not only not even OTA updates keep them safe (and you can argue that with some manufacturers such as Samsung, OTA does is the primary risk vector!) but they can eg.: ship with unfixable vulns at the hardware level that would lead to ditch the whole thing anyway.

So long as there isn’t something like a state-funded program for citizens to renew their phones every ~2 years for fully open ones, I’d not worry much. After all, the other option would be not using a phone because current ones are a PITA and just as vulnerable from the other end.