I would think not, but my cluefulness regarding Android security/privacy is effectively nil.

Actually Android devices (especially older ones) are known for in many cases sending extensive data to the manufacturer on network connect. See for example: https://www.nytimes.com/2016/11/16/us/politics/china-phones-..., https://balagetech.com/android-app-phones-home-china/

I didn’t check what permissions it was given by default but hopefully not too many and with those not much spying. It would be nice to have a clear map of what data can be obtained with what permissions.

Obligatory mention: mbasic.facebook.com it's like a clean needle exchange for Facebook.

That's nice. I deleted my fb but sometimes groups will require it for events and discussion boards.

There was a dark phase when it looked as if the only way to sign up for various services was going to be Facebook. If memory serves, there was a time when Spotify sign up required Facebook.