I'm going to keep blatantly promoting the Librem 5 [1], which is designed specifically to address these concerns (not affiliated with them, just a fan).
I'd be careful about promoting vapor as people tend to get annoyed when they don't get their product. If Purism ships, I doubt it will be anything decent. They are absurdly under capitalized for what they are trying to do. I'd love to be wrong but I'd happily bet 5 figs that I'm not.
Why do you say they're "absurdly" under-capitalized? They already make laptops. The phone's hardware seems fairly standard, no risky R&D gambles, and the software is Linux/OSS...
They re-badge laptops that someone else makes. It's not like they have their own factory in China. In this case they are not re-badging, they are building their own phone and phones are considerably harder to make. There are QA processes that require machines that cost >$1M. It puts them into a situation where they have to trust their manufacturer 100% and pray.
Essential spent ~$100M making their phone and they had help from Foxconn and awesome industry connections. $2M isn't gonna cut it.
Why not Android without the Google services, e.g. LineageOS or CopperheadOS? IMO, for the category it targets -- devices for users that have neither the skill nor desire to be their own sysadmin -- Android is technically superior to the usual GNU/Linux stack. GNU/Linux is moving in the right direction with sandboxed Flatpak apps, but Android is already there. Also, Android is a thoroughly mainstream platform. So if you don't want to be a free-software purist, you can run individual proprietary apps, as long as they're available outside the Play Store and don't require Google services. With a GNU/Linux system, unless it can run Android inside a container, you're basically limited to web applications for anything mainstream.
Android is thoroughly insecure, and proprietary apps do not generally work without Google services. Google has successfully convinced, for example, nearly all apps using location, to use Play Location Services instead of Android Location API. Apps tend to just crash out without Play Services.
Even Microsoft, which is Google's direct competitor for all of these services, hilariously depends on Play Services for nearly all of their Android apps. Office, Skype, etc. all will not run on an Android phone without Google.
I have a Windows Mobile phone these days, and for all the jokes about it being dead: I actually have a wider app selection than AOSP users. Android is a proprietary OS, and almost none of it's apps today are compatible with the open source version.
There's always the Amazon Appstore. And with an open-source Android variant, you could restrict apps that demand over-reaching permissions, including the Amazon Appstore itself.
The Amazon Appstore is trash, and many of the apps in it are out of date or outright nonfunctional. When I tried using Skype on my old Android phone, and it required Play Services, I was mystified because it was also available on Amazon.
As it turned out, the Amazon Appstore version was so out of date it just didn't work anymore.
[1] https://puri.sm/shop/librem-5/