Correct me if I'm misunderstanding something, but I think you can still control Nova's permissions through your phone's App Permissions manager just like any other app. I didn't allow Nova any permissions even before they were acquired, and I certainly don't now. Does that help with your very valid privacy concerns?

I resonate with your sentiment against minimal launchers and in favor of FOSS apps. I've tried a few and haven't found any I like.