True, but those protections are enabled by default (on Pixels at least). Users don't have to do anything here.
> And from what I remember, a plain AOSP install seemed to still phone home to Google to check for Internet connectivity and whatnot.
You're not wrong, but GrapheneOS and CalyxOS are valid options, if you don't trust the ROM Pixel ships with. Even with a custom ROM you're left trusting the OEM. It'd be nice if we could have an open hardware / open firmware Android, but it hasn't happened, yet.
Google Pixel hasn't used Qualcomm chipsets since the Pixel 5.
It absolutely is. Default setting matter a lot!
It's great to have extra security features too. But even experienced users won't change defaults if they have too much cost. If things are turned on by default then those costs diminish because other software has to work within them.
Cryptographic verification of the boot chain with Hardware root of trust are real. Heavily sandboxed userspace is real. Everything else would seem to be a reimplementation of common best practices (disk encryption), or a mitigation of a self-created problem (there shouldn't be binary driver blobs running on the main CPU to begin with).
And from what I remember, a plain AOSP install seemed to still phone home to Google to check for Internet connectivity and whatnot. From my perspective it's awfully hard to put my faith in an operating system primarily developed by a surveillance company, as the working assumptions are just drastically different than mine. And trying to question those assumptions with independent devs are often dismissed (for a particularly striking example, see LineageOS/"Safetynet").