I live in a country that is not fully authoritarian but is increasingly illiberal. State agencies have been caught misusing spyware to target activists and dissidents on multiple occasions. Given the kind of work I do, my threat model is that while it is unlikely that I would be targeted by a Pegasus-style targeted spyware attack, it is certainly not impossible. However, rather than a supply chain or physical device attack, the most likely vector for me would be some kind of remote vector attack. I have no evidence as yet that I have been targeted.
I have a choice at present. I am tempted to just physically get a new phone frequently - perhaps once a year or less - in the hope that that will ensure that if my device is compromised it will at least soon be replaced. Of course however this costs money.
On my present device, I have been using LineageOS in the hope that this will ensure more regular updates. Unfortunately for me :), Lineage discontinued my device soon after I acquired it, so it is still on Android 9 (Lineage 16). Recently however I've discovered that crdroid lists my device as officially supported and has official releases all the way to Android 11 available.
So I want to ask - if I reflash my phone with crDroid, how likely is it that any malware / spyware would be able to survive that? I know baseband OS hacks can survive reflashing, but I had the impression that most such hacks require physical access. Overall, is it safer to simply get a new phone?