OS 
1. If you're "default setting" person just use stock android with Pixel or Iphone (you can consider lockdown mode).
2. If you have time and want to upgrade your security/privacy approach.
Use Pixel 6+ with DivestOS (install and updates via Tor (dos has this feature, disable supl)
or
install GrapheneOS manually! via Tor, turn off all connection to GrapheneOS servers before first connection. Disable App app, turn off automatic time update, supl, internet connectivity checks etc 
IM
1. Android - SimpleX, Iphone - Imessage.
2. Android - Conversations (xmpp) own server, consider using .onion address, SimpleX. Iphone - SimpleX
VPN
1. Do not pay for VPNs. Android - Orbot (Tor) + specific apps or apps which utilise socks5
2. Android- Orbot with full VPN mode, block connections without vpn.