It’s why I have never added apps, websites, etc that have any financial information - i.e. Amazon and the “Swipe & Pay” apps are just begging for a hack.
I buy burn phones and never add a Google account or carrier account. And only use calling, text, contacts, camera, Data, and file manager. No others, And these few are usually default from the phone manufacturer and not from the carrier or Goggle. So even though it is android, it is unhooked from Google services.