Hands down the most advanced and secure smartphone os is grapheneOS.

https://grapheneos.org/

It only runs on pixel devices. App sandboxing, buffer overflow protection, separate users, optional sandboxed google play if you need it for banking apps, automatic reboot after a set time to re encrypt your filesystem, assigning permissions for app access to folders and the list goes on and on.

If you are looking for a hardened phone, I would consider trying GrapheneOS for a bit, see if it does what you are looking for. Uses SELinux and a seccomp-bpf policy for app sandboxing, as well as runs a hardened kernel with a hardened memory alloc. Great isolation approach, too, so that you can run apps on a 'completely different phone,' so to speak -- think of the isolation like a small version of the OS that can keep apps entirely separate. Finally, if desired (and needed for certain apps), you can sandbox all Google services so that they don't have direct access. It's is a different approach to, say, microG.

GrapheneOS is all about hardening. Security is solid.

VPN wise, Mullvad wireguard servers are also solid. You can do multihops, which help you obsfucate traffic to degree. They have also been playing around with packet shaping (if you use their app directly).

Sim cards can be swapped out if use a VoIP service like jmp.chat.

if you're using CalyxOS it is not hardened.

If you're serious about Android privacy, check out ReThink! It blocks everything by default and lets you control exactly which apps or IPs can connect. https://github.com/celzero/rethink-app

But honestly, what is your goal? If you want it to be a safe phone, just degoogle, install one of either Graphene or Calyx(dont ask me which one is better, I have no idea of either), dont install random apps you dont need, encrypt important stuff and you are good to go.

SIM tracking is another ball game, maby dont even have a SIM card. PIN lock your SIM card, only put it in your phone when you have to.

Maby put your phone in a Cement for more hardening /s

What are you trying to accomplish?

You capitalized spy, surveillance and hardened but I’m not aware of any specifics those words bring to the table when applied to phones.