As developers we might be used to paying 100s of euros (or signing up to a contract to effectively do the same over time) on a phone, but the point is $grandma may not be willing to spend even 20% of iPhone budget (and definitely not replacing it by the time OS updates end)
Were you expecting security in broken systems like Android? Instead of forcing security onto a broken system, just avoid that system?
The fist step of security: stop using Android.
And you haven't explained why your grandma is tied to an ecosystem. I'm honestly asking if she's a developer or not?
What is her use case? Why does she need to be on a specific platform?