Great question. Believe me, I too want a non-Apple, non-Google solution. Ideally, we'd figure out a way to support a true "public commons" for phone apps, one that also supports an ecosystem of trust/reputation based "security validators/assessors" that provide independent assessments of apps on the public commons. People would be free to ignore these assessments. Or something.

To be honest, I have been recently looking at trying out an Android phone that supports Lineage, but the 2FA issue would be a deal breaker. Is it just some 2FA, or most/all?