Security researchers will always break into, reverse engineer, and scrutinize OS firmware and apps.

They’re not going to find every backdoor. But I’m sure their work serves as a deterrent to some degree. Vendors aren’t going to deploy backdoors unless some state actor forces them to, and even then chances are they’re caught and called out.

Security researchers will also happily sell their tools to law enforcement and other agencies. Companies like cellebrite specialize on that.

In short, if you are being targeted (and, granted, the chance of that is pretty low), your data and communication is not secure. It's an economical question, not a technological question. (the FBI paid $1.3m in one case to get access to a phone).

If you care about it, switch to Librem 5 or Pinephone.

Neither of these can access the financial services provided by my bank nor the infrastructure provided by my city

This is worrying. I always thought about this since I have long-standing user experience with privacy-related stuffs and the more you block, the less you can use. But being unable to access financial services or city infrastructure provided by your city makes me think that either these services are terrible or the privacy phones are breaking something. Case in which I am most curious to find out what exactly are they breaking and how are those things both essential and privacy related? - I'm unsure if my sentence makes sense, English is not my first language.

Removal of KEYGEN feature from Firefox and other browsers was a major mistake in this regard.

My bank(s) used password+client certificate, but now they have switched to proprietary mobile OTP apps. (also due to some directives). For some stuff, SMS codes are used.

Also, I've seen CA's simply deliver the .P12/.PFX file now instead of securely generating the key on the client and then signing it.

Seems like your government supports the duopoly, which you should fight against.