I think some kind of privacy sandbox & data escape logging would suffice to allow data leaking apps, to run on a libre type OS.

The main thing an OS like this needs is the a ability for it's users to run their own "cloud" infrastructure and attach that to their own phone.

Company can offer this as a SAAS service paid, providing they to proper end to end encryption and are not able to read the data they store. Also a good way to fund future development.