It's a Pixel 3a XL, which does seem to be one of the better-supported phones on PostmarketOS, which I see has renamed itself Nura and might work better after a reinstall instead of an upgrade in place. It still doesn't claim to be ready for a general audience.

how is android not getting to be just as bad [as iOS regarding vendor control over app installation]?

Android is absolutely getting worse, but it's not as bad yet, and as bad isn't on the current roadmap. Important with regard to that is "Android" can mean more than one thing, including Android Open Source Project, Google-certified Android with Play Services and the like, a vendor distribution, or a third-party distribution. Even the worst case, a notarization-like system on Google-certified Android coming in the future, will be possible to turn off with an officially-supported procedure.

how can anyone trust their personal data being safe

You can't trust any of these megacorporations to do anything other than maximize their own profits, Apple included. It's possible to decide exactly how much Google stuff you want in some of the above descriptions of "Android" with increasing hassle as it approaches zero.

and if you are running graphine or the like it’s the same boat as the linux os options

No it's not. Open source Android distributions usually use kernels compatible with the OEM proprietary drivers, so stuff actually works. Something like that might be possible for desktop-style Linux, but that's not what the existing distributions actually do.