I recommend GrapheneOS.

Supported devices are usually older models, and often there are newer devices

Usually. If you want a new phone, your best bet is Google's Pixels, OnePlus (although recently, it's been weird), Nothing probably too. Google's phones in particular have a long history of being really easy to develop for, you can pretty much just build AOSP and it just works. They're community supported for a really long time.

Most other brands make unlocking their bootloaders either hard or impossible, and to even just root, you need to unlock the bootloader anyway, at least the way without exploits. Since unlocking the bootloader is the big hurdle, root and custom roms tend to come together. So a phone you can root to debloat as your second option would probably also be suitable for option 1.

Sure, it's in the pricier range, but if you value the ability to control your operating system as much as I do, it's worth the price. Plus, I think my OnePlus 8T will hold up great for the foreseeable future. It's way more powerful than I need, so I'm sure it'll take a few more versions of Android. I'm using 4-5GB out of the 12 it's got on average, they'd have to seriously bloat up AOSP to use all that. I've dealt with cheaper devices and they just kinda suck, stock or not.

I highly recommend GrapheneOS on a Google Pixel. You can also get a used one, just make sure to buy a Pixel 6 or newer, as the models don't get security updates anymore. The Pixel 6 is supported until October 2026 (~3 years). You can check out the entire list of supported devices and the minimum support length on this site. Pixels are a fantastic choice for security because of their Titan M security chip which has support for various Android security features like the Weaver API which throttles unlock attempts making brute-force attack unfeasible, Android StrongBox, and Insider Attack Resistance.

GrapheneOS is really awesome, by default it doesn't include any Google services making it an excellent choice for privacy. You can install Google Play services, but they will run in a sandbox, you have the ability to restrict what Google has access to on your phone. They also make significant security improvements like hardening the memory allocator, the C library, SELinux policies, etc. What makes GrapheneOS so much better than other ROMs is the fact that you can relock the bootloader and make use of Android Verified Boot with GrapheneOS' custom signing keys.

You can watch this video or read the official documentation to learn more. My advice: Stay away from insecure ROMs like LineageOS.

I don't know your exact needs but I have been using nothing but < 100€ used devices for the last 4 years and its been mostly a great experience! I especially can recommend older Oneplus phones before the 10, as they make it easy to unlock the bootloader and flash stuff. Also the Pixel 3 and 4 are quite cheap and offer a lot.