It is very ironic that the solution is using an old, insecure phone full of unpatched holes for all important banking and id business, because that one is vendor-allowed while your state-of-the-art GrapheneOS is not.

If only banks cared about state-of-the-art security.

In reality, banks couldn’t care less. They only care about checking boxes and don’t consider where these boxes come from; every unchecked box is a risk.

Did the latest sham "security audit" say that root is bad? They'll block it.

My job's SSO moved to provider that either required an unrooted phone or a reliable Voice auth.

For 2 years the voice authentication worked fine (they call me, I type in a number) on my regular rooted phone. Then one random morning I just stopped getting the phone calls. "Network said no".

Complete lock out, nothing I could do except go out and panic-buy an unrooted phone not running Lineage and using a modern Android version. (I tried my older unofficial lineage phones without root, and no dice.)

I opted for a good phone I could postmarket later, but gosh did it set me back almost 1/5 of my monthly salary.

This does sounds like the situation where the employer should provide you with the phone.

Indeed. Never spend your own money on work related expenses. If your job requires a phone, they need to provide one.