I don't see a solution to allow for the privacy you gain via adaway and automation you get from tasker. But also every alternative that comes to mind (rooting, custom roms, iPhone) will compromise your security or give you less privacy.
What I'd do in your position is making extensive use of the user profiles and set them up however I need. Maybe owner profile for app installations and updates. One user profile with always on mullvad or nextdns to block ads and trackers there. Another for offline use, another for local printing etc.
It's not very convenient, but with your threat model (or what I can see of it) any current rooted solution would be worse. Also think of the features you don't get elsewhere, like duress pin, 2fa pin, contact and storage scopes, mac randomization, sensor permission etc.
In the end it's a compromise you have take. I wish there would be good alternatives to GrapheneOS security- and privacy-wise, but for now it's the way to go and I'm very grateful it exists.