Installed GrapheneOS - Current Plan, Minor Frustrations, and Next Steps

Orbot or another free, private VPN running 24/7 (some recommendations here would be nice)

  • Proton VPN is free, however you have a few limitations

Outdated-looking stock AOSP apps. To make it worse, I’ve looked into potentially replacing them but have read that it could cause issues (keyboard not showing up for phone unlock, phone calls or alarms not showing after a fresh reboot, potentially contact scopes feature not working with a custom app, etc.). Is there any way to deal with this issue? If so, what are some recommended apps for privacy and security?

Could you share the apps? I never encountered an outdated style of an app.

On the Pixel there is fingerprint unlock with a 2-factor PIN which seems fairly comparable in terms of security for my threat model, but the fingerprint sensor on my phone is extremely unreliable and won’t work 80% or more of the time, making it effectively nonexistent.

I own a Pixel 8a with GOS and a long (6 words) passphrase with symbols as a password as well as Fingerprint with Pin-MFA.
Since I’m also someone who drops the phone often (5 meter from a building on a stone, in the bath, on my motorcycle, gotten ran over by the bus – the smartphone not me – and so on) I use a very strong tempered glass and never encounter these typed of issues.
There is a specific setting in the security settings tab to turn on something similar to “tempered glass mode” which helps to mitigate such issues, if this doesn’t work than I could only suggest you to buy another glass.

PIN unlock on the Pixel seems to be resistant to advanced brute-force attacks, but I am concerned about someone manually brute-forcing the 6-digit PIN I use in case I lose my phone or have it stolen. I am at a loss for what to do here.

A 6-digit PIN is at least on an Pixel 7/8/9 with up to date GOS secure enough to withstand APT and state-level attackers as far as we know according to the latest cellibrite leaks and GOS own recommendations.
So if you are not an Edward Snowden or a country leader, the 6-digit PIN should be enough.