Disabled code is still an attack surface, sadly - and the false sense of security might make it a net negative. A different os build would be better.

Sadly, the biggest surface, aside from the users themselves, is likely still the web browser. With them being nothing short of mini OSes, I am not sure one can make a secure modern phone. If you have secrets, design your opsec around the assumption that your phone is easily hackable.