You’re right in that its fully documented, but it seems your understanding differs from the documentation. Your provided link explicitly says, “Opening a port directly to the Internet is therefore insecure and not recommended.”

I don’t use any banking apps, but from what I’ve seen on forums it can be hit or miss depending on the bank. I only use their webpages. If my bank required an app, I’d find a different bank.

There’s no guide since everyone’s use case is different, and 100% is only obtainable if you avoid all tech. GrapheneOS or buy an iPhone are the best options. I went the grapheneos route, but I still use google play services as I found its the safest way to still get apps for now, and the disconnect from google is still much more than using stock android. I moved email to proton, maps I use OsmAnd.

I’ve been using graphene for a few months, but this latest news was what reminded me to start a monthly donation to the project. Hopefully Googles shenanigans push more people towards funding alternatives as well