How "hardened" is it? Can you completely control network traffic and permission access of every installed app?

For example, if you wanted to spoof the android_id (something you usually can't do with regular permissions) to some app, could you do that?

Also, is app storage isolated? This is a new feature in Android 10 but a pretty easy way to allow for cross-application tracking/fingerprinting in earlier Android versions.

I currently run Lineage with microG but I still had to get root access to effectively counter those things.

As an alternative look ar RattlesnakeOS: https://github.com/dan-v/rattlesnakeos-stack

Needs a Google Pixel but you can customize all kinds of things and still have a locked boot loader.