I went the /e/os way and quickly turned back. Not to dismiss the effort of the maintainers, but it really felt like a frontend on lineage os meant to sell alternative cloud services. I did not find convincing arguments over a bare lineage os and the pretty much forced /e/ cloud was a total turn off.

I went the “real” security / privacy way and switched to grapheneos. Very happy overall, already went thought with 2 major os updates, no issues whatsoever. Only issue would be if you want Google pay (won’t work on graphene). You’d need a pixel phone if that’s in your budget. The pixel phones are great at photos, but pretty “meh” otherwise

I’ve seen this news published at a few different places, and IIRC they plan to use already existing exploits. You can read a bunch about what could potentially be used on the grapheneos website, specifically on how the modem and cellular network stack is very highly privileged on android at least, and it is very likely that most cellphones are vulnerable to some kind of code injection via a stingray, for example.