No, sandboxing exists in Linux and tools like firejail are built-in in Debian/Mobian.
> How are app specific permissions handled?
With fine grained security profiles.
Besides, this is all largely irrelevant when the average android TORCH app is a blob of closed source code that can do telemetries.
Contrasted to FOSS applications developed in the open, reviewed by package managers and users, built reproducibly.
> How full e2ee or secure boot is implemented?
It's there and it works. And secure boot is really unimportant for the attack vectors of most phones.
> By default, you have to add alot in top of Linux kernel.
Not at all, it's all supported by seccomp, cgroups and co.
In comparison on Android or iOS Autors directly upload unauditable binary blobs to an app store that then pushes app updates without almost any user control, often fully automatically. Sandboxing makes more sense in this context as a result.
There area already many closed source apps such as Spotify client or Slack. Nothing is stopping those apps to read your browser cookies if they want, in case they are installed as regular apps and not sandboxed.
Citation needed. Android does plenty of homecalling and also a lot of phones came preloaded with bloatware with tracking functions.
You have to provide some justification to claim that a Linux phone protects users privacy less than Android.