Once LinageOS is installed your bootloader is always unlocked so anyone who finds your phone if lost owns it. GrapheneOS and a few other ROMs I forget the names of allow the bootloader to be relocked keeping android security model intact allowing the device to still be secure.
bradboimler
Works on GrapheneOS
This just seperates it into a secondary profile but all apps in your main profile are already sandboxed as well the only apps that are not sandboxed are system apps such as Play services. But you could use the app in a work profile(shelter) under a seperate Google account that would add a bit more anonymity. But android default app sandbox could be more secure there are other custom ROMs that do just that making the regular app sandbox even more secure.
Here is more information on how each android app is sandboxed(except Play Services)
Glad I don't use any Google services and no apps on graphene OS then for my main computers I run Fedora silverblue with no Google once again.
That sucks my bank app doesn't seem to rely on it for anything other than notifications and I can live without those.
Because I am trapped here and have to use current tech and you know I dont do off the grid! 🖖
I have a work gmail as well with works apps with Google Play but it's in a work profile so separate from. Main so I understand that.
Thank you will look into $5 isn't alot so will probably switch to it.
I use McDonalds App all the time on GOS this only affect you if you use Google Pay when checking out to my knowledge.
Odd I used it to install GTA: SA definitive edition purchased on the play store website then installed and updated via Aurora still works just updated it recently too.
Is it the pro or the tube shield the tube is 32 bit only and most apps and games have moved to 64 bit only so the pro would be needed but I can still install paid apps on aurora on my phone just fine.
My last bank did that so I switched banks my new bank app works without any play services installed on GOS.