Removing by ADB is fine if you are able to identify which packages should be removed or if they’re already covered by Universal Debloater. You should also use Invizible Pro to control what connections are made and block trackers.

Gboard isn’t open source, which is why I disable internet access for it.

It isn’t a system app for my phone, so maybe. You could still use something like InviziblePro or RethinkDNS to disable its internet access without root though.

I use Gboard but with internet access disabled for it. I haven’t found a comparable open source keyboard yet.

Would “plus” addressing work for you? https://proton.me/support/creating-aliases

I don’t.

You can see what connections go through. No more than with GrapheneOS, and with stock I don’t have to trust the mentally unstable with my security.

Remove Google apps as part of the debloat process, restrict permissions beyond what Android allows by default for all system apps, using App Ops and Shizuku. Accomplishes the same thing as GrapheneOS.

You can make stock Android much more private. Universal debloat tool + Invisible Pro - remove unnecessary apps, restrict internet access to only the apps you want to have internet access, add a tracker blocker list.

My experience has been that Nextcloud can do 1000 different things, and it sucks at all of them.