Glances over at my 1954 GE Combination that has NEVER been serviced outside of cleaning and replacing the light bulbs.

I believe you can… I have google maps installed and disabled (frozen) by default in case I absolutely need to use it.

A last-gen refurbished pixel + GrapheneOS has been my go-to for years now. Gives me all the polished featured of flagship hardware with regular security updates and privacy.

Bonus points, the google play compatibility shim means you can run 99% of apps that are on the play store.

Just test the refurbished phone thoroughly on the stock os in case you need to swap it out.

Generally agreed, I would actually try using as many services with their progressive web apps.

The main reason I think they may need google services is the banking app. Mine will refuse to launch without google services installed.

You sound like the ideal candidate for a refurbished Pixel 7 / 8 from amazon.

Test its hardware thoroughly on the stock os in case you need to return it.

Install GrapheneOS using the Web installer.

Install Droid-ify into your main profile from the f-droid web page. It looks much better than the official f-droid client and actually has a working auto-update

Create a work profile. I use an app called Shelter as the work profile admin app. This allows you to auto freeze your big-tech apps to help with battery life / privacy. Install google services from the built-in GrapheneOS app store.

Enjoy.

You are correct, a VPN connection does not bridge to another profile. You can install a VPN in said work profile. The always-on VPN settings in grapheneos have the work icon to indicate what VPN is in your work profile.