Fully agree. Just not sure how much benefit a debloated Custom ROM is vs. a debloated stock Android (let alone oneUI etc). GrapheneOS seems to be the only good way to go.

Apart from GrapheneOS, all other android ROMs are less degoogled than you think, as confirmed by many security researchers. For less techy people the order to degoogle is:

1. iOS as OP did
2. android with Universal debloater (likely still contains more google than iOS, as LineageOS, e/OS etc.)
3. GrapheneOS on Pixel hardware

KeepassDX on android, Linux and Mac.

Keepassium on iOS. Needs manual reloading after background sync of database.