A headphone jack is just another attack vector! Use your head!!!

no headphone jack, no SD slot, comes with /e/OS.

• I personally didn’t need jack but I understand it might be problematic for some. If you create music for example you might not want the latency but for that I have a dedicated PBG-1 (OSHW grove box) which does have jack. FWIW there are USB-jack adapters.
• it has an SD slot, I have a .5To inside
• comes with /e/OS was the point for me. I wanted a deGoogle Android without any tinkering. If you don’t want that though you can buy straight from CMF but I don’t know with what ROM they will ship.

In the end any mobile phone is inherently privacy invasive because of tracking by the cellular carrier, and the unending security bugs in the software. It’s hard to do much about this.

• if you don’t trust cellular carriers you can setup your own network, e.g. https://www.crowdsupply.com/ukama/ukama but… yeah that’s a bit demanding and obviously nobody else will connect to it. You can use eSIM but still have to trust the resulting carrier. You can rely on WiFi only but same, trust the ISP or encrypt everything you can, have your own VPN elsewhere and hope you can go through deep pack inspection
• on bugs in software… but I like https://www.crowdsupply.com/sutajio-kosagi/precursor is exploring the idea, pragmatically, of verifying the whole stack, hardware included, but it doesn’t go to mobile packed. One could consider this with simpler modem equivalent, e.g. LoraWAN, but with the obvious bandwidth limitation. None of that removes bugs but if the entire stack is verifiable at least it’s about genuine bug, not backdoors.