But what about baseband firmware? It's quite a bit scarier. It can usually freely read and write into application processor memory and it controls all radios.
Baseband is where you'd hide your spying software. It does not change when you install a different Android version.
True. I don't see much for Huawei on Lineage, but Xiaomi has builds for most models. Unlocking takes a while, but can be done. My phone actually came unlocked because the seller changed the ROM language, I assume.
If the bootloader is locked or there aren't any good open source builds, just don't buy it.
It really stinks that there are barely any new phones available for purchase with unlocked boot loaders... you have to rely on hacks to replace the software that rapes your privacy.
I have a Nokia. I think keys to unlock most new models are available from Nokia (was in my news a week or two ago.)
BTW: my phone was super cheap, like less than USD300, no strings attached. It is great for most of what I use: mail, hn, local news, signal, slack, telegram.
It's also part of the android one program so I expect it to receive updates faster than my old phones.
The camera (or the camera software) has some real problems though: it's not as good as my older samsung S7 and it sometimes freezes.
Maybe the slightly more expensive models have better cameras, mine was about the cheapest reasonable phone I could get.
Yeah, but given we are complaining about data collection you can buy yourself out with Sailfish OS for 50 EUR or install microG (such as with LineageOS). I've done the latter on a FP2, but Sailfish OS would be a suitable alternative.