A good privacy stack is local-first, as GHOST (a blogger I read religiously) explains here:
He has over 80 articles, probably creeping up to 90 or 100 by now.
For this setup, you’ll probably be recommended to get a Google Pixel 9 (not a 10, because bad batteries) or earlier (if still supported) with GrapheneOS, or wait until the Graphene OEM model comes out soon. That could probably be used as a non-sim phone. Your other one with LineageOS, without GApps, on the OnePlus12 is fine I think for SIM. However, if you want to make the OnePlus your non-SIM phone, and your Graphene devices your SIM phone, that’s not an issue either.
If you need an iPhone for some reason, get one that’s used and in good condition (much more affordable that way). Put it on Lockdown Mode if you can, and only have that as a work phone if necessary. I’d try to get Android with what I mentioned above, but they might have a desire to put bossware on your device (basically, spyware your employer installs, which there’s an article on GHOST’s blog to deal with that).
For a laptop, I’d stay away from Fedora and/or RedHat based stuff due to what’s being forced on those distros (Wayland, PipeWire, systemd, etc.), and instead, use something like Linux Mint, Pop_OS! (both Ubuntu-based), CachyOS, vanilla Arch Linux, or Artix Linux [systemd-free Arch] (Arch-based).
Now, I get it, most of it’s systemd, PipeWire and Wayland, but you have the option to keep them or use X11/XLibre, PulseAudio and JACK bridged, and for Artix, Void, MX, and some others, other PID1 such as S6, SysV-Init, Runnit, OpenRC, etc.
If you especially want to do video editing, I’d stick to Mint, Pop, or Cachy (I daily drive Cachy), and use Kdenlive, AppImage format unless the OS package works for you. For MS Office compatibility, I’d stick to OnlyOffice if you wanted that. All of them are local-first.
I can break this down into simpler terms if you need me to.