Correct me if I’m misunderstanding something, but I think you can still control Nova’s permissions through your phone’s App Permissions manager just like any other app. I didn’t allow Nova any permissions even before they were acquired, and I certainly don’t now. Does that help with your very valid privacy concerns?

I resonate with your sentiment against minimal launchers and in favor of FOSS apps. I’ve tried a few and haven’t found any I like.

I like Nova launcher, personally.

Just in case you want advice, I’ve found that using a custom launcher app solves that problem for me. I spend an hour setting up the interface exactly how I like it, then never change it again. When I get a new phone, I load the launcher settings from the last phone into the new one, and everything looks and feels exactly like I had it before.

Inspired by this post, I just created a phishing test for my staff with a malicious URL in a “report this as spam” link, complete with a required training for those who click the link.