1. Turning off Apps app / autoupdates for apps like Vanadium means you won't get updates for apps when available, only through OS upgrades. When it comes to setups involving Sandboxed Google Play and GmsCompatConfig this can cause app compatibility issues. Had history of people reporting apps breaking, just to find out it was because they didn't update them or the OS for months. We don't recommend disabling them at all unless you know what you're doing. 

2. DivestOS uses a partial share of GrapheneOS hardening. GrapheneOS defends the DivestOS project as well. The developer had also helped produce patches for some of our apps in the past. DivestOS' developer recommends GrapheneOS above his own OS. Some builds have less hardening due to device specifications.

See a more full comparison at: https://eylenburg.github.io/android_comparison.htm

3. I can't suggest a VPN provider for you. That's up to you to pick one to trust.

4. DivestOS upgrades apps via F-Droid with their own hosted repository while we use our own via Apps app. 

 Thanks for the info. Educational, as usual. I'm glad we can go straight to the source on these things.  

 DivestOS has own instace of F-Droid  and they have .onion address to use it via F-Droid app.
They have 3 mirrors within Tor (onion addresses).

If you have no time to customise GrapheneOS or other custom rom just don't use it.

It' safer for your personal data to use Iphone (consider lockdown mode) or Pixel with stock Android.