The only hope one has of reducing one's assault exposure profile is the fact that the carrier's network is their lifeblood, so they have a dollars and cents interest in keeping your individual connection mostly clean and not exposed directly to the internet without the same prophylacytic filters they use themselves.
I don't think we can count on the carrier working for you in that context. (especially not in the North America market, where telcos have been given much more leverage to exploit their customers than here.) Better then, if there's a choice, to network the phone via infrastructure you control and can monitor. Good luck, for instance, keeping DNS lookups out of marketing hands if you're on the LTE connection. If you are on your own wifi, you can run your own full-service resolver that talks to the root servers. (the joke that is DoH is something I'm not even condescending to talk about. *barf*) All other wifi networks of course are off-limits. If there's "free wifi", it's because your traffic is the product. I'd be OK running a VPN I control myself over that, nothing else.
or give up
THAT is kindof where I was going with that... At least with that route, I'm not counting on my own weak Kung-Fu and decades-out-of-date CCNA cred to ensure the safety of that drippy little data sponge bleeding packets like a wounded buffalo; I know just enough aboot the IT infrastructure I repair and maintain for a living to be fucking terrified of it.
At least by limiting my own WiFi access, I can be reasonably certain where most of the leakage vectors are: My carrier and fucking Google. I stay logged out of all Google Services as much as I possibly can, I don't install apps that demand them when they aren't absolutely necessary, and I keep location services turned hard off; even when I'm actually using my GPS I use offline maps unless I'm going downtown and need live traffic data.
I get where you're coming from and I agree; but I'm a user, not a Network Admin anymore. I don't have the energy for the eternal vigilance you're advocating here; that shit is a young man's game, like I was a couple decades ago taking my Computer Forensics courses at Alamo City CC...
So now I keep my own and my wife's PC on hardline, I use my VPN and a completely different browser when I need to do anything financial, and I treat my own WiFi (even tho I do keep it on a different untrusted subnet and use MAC Address Filtering) as if it were the WiFi at McD's: full of cooties and shitcocks looking to assrape me.
Actually, right now I even have both our Windoze installs configured as PUBLIC with Discovery disabled just in case, as we have no network storage right now. Even our Rokus are on their own VPN when connected to WiFi.
It's an imperfect solution; I'm sure full of holes. But I have no delusions that I'm going to keep out a determined hacker or leech. I just wanna make the script-kiddies roll on and look for lower-hanging fruit.
mnem