You have done good research and are now looking at a list of valid alternatives. They don't differ much in your use cases and are often forks of each other anyway. Grayjay doesn't require you to log into an account btw, but you're correct that it's source available and not truly open source. I'd also put FreeTube and Skytube on that list just for good measure.
At this point, I'd just use whatever works best for me regarding user experience and feature set. Tubular for example is a bit behind and might therefore break more easily (and for longer due to slow updates). It's coming with Sponsorblock though (compared to NewPipe) if you value that feature. Rule of thumb: Go with the Original if the features are sufficient and with a fork if you require whatever they add or remove (and if you trust the additional developers).
Regarding privacy and security, my take is that all your solutions are sufficiently private and secure when running on GOS and without logging in. You have to trust the app developer anyway for the little data you share, and maybe it's negligible depending on what you need to protect and from whom.