Okay, in that case, I would just buy a very cheap second device and have your primary one using a privacy system such as graphene and then use a secondary one that you never turn on except for doing that kind of stuff.

That way, at least your primary system is isolated from the rootkit that is things like Google Play Services.