This is a tricky question that can't be answered on computers either even if you run Linux since the package manager can be compromised etc. In case of phones, best bet would be GrapheneOS with verified boot so there isn't a chance it'd get infected.