Maybe Linux phones are less secure but more private? With Android and iOS a lot of effort has been put into restricting what each application can do. With standard Linux that’s less rigorously controlled, which is why there are security enhancements and sandboxing extras a distro can optionally add. So standard Linux may be less secure by default. But it doesn’t have all the surveillance built in that the mainstream phone OSs do, so it’s also by default more private.

Still, “security nightmare” sounds extreme. Wouldn’t a phone running a version of Debian be comparably secure to a computer running it?