Here's one of those occasions where Linux mobile is shining, Wireguard(kernel) works OOB in Mobian, Requires custom kernel in postmarketOS due to Alpine quirk.

Considering the added benefits of taking your other desktop Linux security configuration to mobile, A Linux mobile could be a viable choice for those who need reliable transparent security.