highlander
For apps:
Your foss apps are generally ok to be in any profile and ok if you mix them with any non-privacy-respecting apps on same profile. They don't talk to other apps and don't give info away. Its the corporate apps you should be careful about. I have already explained this in one of those links I sent you.
How you split your apps is unfortunately truly a personal choice as different people's decision on the privacy/practicality scale and how much they use an app varies.
Antennapod - install anywhere. If you want music apps antennapod is not the best. Search this forum for the words "spotify" and "music" to find some good options. I can recommend vimusic and innertune. They pretty much do what Spotify does.
Openboard - install anywhere. Swift and gboard are much better keyboards however, but IMO you have to be careful with their IPC, specially gboard. Openboard is a good start. Switch down the road.
Keypass / vpn app /aves - install anywhere. For your vpn app make sure its a trustable company.
Proton suite - in your case probably safe anywhere, but think about whether you want notifications for your email. If yes then you need to put in a profile with google play present. I say "in your case" cause some peeps don't trust proton that much. But for you, its fine.
Whatsapp is gonna be tricky because its a big privacy concern. It knows your real identity and if google play instance is available it will probably link to that google play instance as well as any google account that logs in. The GP instance will likely learn your identity from whatsapp. Also if any other corporate/non-foss apps exist in that profile who dont know your identity could likely discover it cause these apps often share "intel" with each other (either on device or through internet servers).
However putting it in a separate profile will make life a pain in the ass if you wanna use it alot. Also it works without google play but drains more battery (same for signal /telegram ,etc).
So you have to decide whats more important.
Google camera WILL talk to google play (even if its data blocked) if play is present. Whether it gives away any info about your photos to google is unknown. I personally dont trust it so if i have Play installed then i internet block Play too, or if i have Play with internet then i don't install apps like Gcam/gboard/recorder on that profile. But that's me.
.
highlander Again read that Apps can communicate across Profiles anyway due to Local Host Communication but that wouldnt make sense or members wouldnt be using Profiles surely
Theoretically yes, but they have to be programmed for this, and you have to question which app might do this. My point is, its unlikely for most apps to engage in this.
You should also know that running multiple profiles drains more battery, so most people try to avoid it.
highlander I take it each profile basically has all default GOS apps automatically and you supplement them with the add on-s you allocated from the User profile, so each profile is like a stock GOS phone and you are just adding a couple of bits to each.
Yes. But more than a few bits. All settings are reset too, so you have to do everything all over.