The cheapest device that I trusted was the Pixel 3a, and that's because I can cleanly install GrapheneOS and not have google play install. That was $400. It was very tempting to get a $100 phone, but this was my exact worry.
These low-end phones, preloaded with malware, and likely running and outdated and vulnerable version of the base OS with no hope of patches...
Having a hope of being successful in our society right now in any meaningful way requires some level of access to the internet and these bare-minimum phones are it for a lot of people. Security online is a massive social issue that we can't rely on end-user awareness to solve.
This is a supply chain attack that only hurts the worse off. You're on this site which in its own way gives you a certain baseline technical merit; You're actively are aware of the threat of these low-end phones so you don't fall into that potential trap.
The people that can't make that jump between the $100 and $400 phone shouldn't have to deal with additional ongoing personal and financial repercussions from trying to participate in our modern society.
For example many German (EU?) Banks now have some form of 2FA system for credit card payments which requires a Android/iPhone app which does only run on non rooted certified phones. (Through it should be noted that in Germany credit card is not the major payment method and many people don't even have one, instead dbit cards with V-Pay, giropay, etc. are dominant. )
As a site note this is also the case for their online banking Apps, but you can just use their website instead.
...unless their website also has 2FA, and relies on an Android/Apple app for auth. Or you pay them money to lug around a USB device for 2FA.
For both people who have dumbphones or run custom ROMs, despite the security risks, there should still be an SMS-2FA option.
This especially sucks because the people who can't afford a good phone will pay not only in having a poorer user experience but they'll have their financial and social media information stolen as soon as its used on these devices.
That means the people who can least afford (via both time and money) to deal with identity theft will be the ones hit the hardest.