Hb1hf
Can't edit the post anymore, but in item 5, if you're still going to use the app, consider using separate profiles.
For example, definitely separate one profile for banking apps. This has many benefits. You don't use it often, so it's always logged out. If your phone gets stolen/seized, it's going to be closed and encrypted, even if they get your phone unlocked. Additional pro, many bank apps require Play Services, so taking them out of your main profile makes it easier not to have PS in it.
You may also want to put extra invasive apps in their own profiles. The main limitation is that apps can see many phone identifiers, so different apps will know that they're installed on the same phone, even in different profiles. But they won't see the list of all apps installed on the phone and, more importantly, they won't be able to talk with other apps. GrapheneOS let's you revoke network permission, but if you have play services and an invasive app without network permission in the same profile, who's to say it won't talk back to the mother ship via PS?
On a last note, some people use a secondary profile as their main one, and leave the owner empty or with some dull stuff in it.