Any phone that isn't receiving updates is a target for malware.

You need an OEM unlocked phone that you can flash a degoogled ROM onto.