> one of the critical vulnerabilities from a user's perspective is the network connections that a device makes, nominally on behalf of the user, but really on behalf of privacy-forsaking data harvesters like google and facebook

Apple provides APIs now on stock iOS to allow an app to use a “VPN profile” to implement a firewall blocking outbound connections, but without requiring a remote server (aka the app applies rules locally to outbound connections). The downside is you have to trust Apple to pass their own traffic through the app’s firewall unlike with a JB, but at least that covers the other examples you gave.