My incoming mail goes through SpamAssassin at the IMAP server, which does a decent job. All my mail addresses are public on web sites, so there's a lot of junk filtered out.

My phone also uses the IMAP server, so I don't need any Google services. It's an Android phone, but it's never been logged into Google, wasn't bought from a carrier, and many of the built-in Google apps have been removed. (Hint: when you start up a new Android phone, and it wants you to log into Google, click "Later". Then remove the "Google One Time Startup" app to shut up that message.)

This isn't a security thing; it's to block ads.