Instructions are usually pretty clear (eg. XDA posts for ROM releases or LineageOS wiki pages are usually quite clear, the latter being more than the former IMO). It might be harder, but usually laypeople can get by (eg. aren't particularly knowledgeable but perhaps aren't afraid of using the command line either, even if it's just copypasting). At least that's the impression I get from people posting on XDA.

Either way, I can usually flash ROMs without issue (I don't know a lot about Android but I do understand how my computer works, I guess), but when I do it I usually get incredibly nervous and panicky out of fear that I'll brick my phone or I forgot to back up something important.

Well, the fitness band didn't have its firmware flashed. that's not where the tracking is anyway. It's a different app being used to collect the data.

Recent models of many Xiaomi bands require an authorization code that must be taken from an existing account that has linked with the watch. If someone's skilled enough to run a python script they can get the code and install Gadgetbridge.

Tracking for mi band is in the android app rather than the band itself. All you need to do is replace it with a more privacy focused app.