As somebody else mentioned, using a computer and just taking calls there would work and give you solid control over microphone activation etc. If you really want the landline experience, look into adding a USB handset to that setup. It’ll just act like a mic and headphone from your computer but in the classic phone form factor
Professional audits happen for big projects, and hobbyists audit the programs they use frequently. In addition, some projects adhere to the reproducible builds guidelines, which ensures the packages you’re receiving are identical to the upstream repo. There’s more work to be done in formalizing and automating these processes but this isn’t a major issue by any means
Just make sure they know anything they put on these big tech platforms are there forever, regardless of what claims they make about “disappearing messages” etc. Do your best to guide them towards encrypted services for their own protection. As much as I hate this, iPhones are a decent recommendation in the US since almost every young person uses iMessage as the default, and that has end to end encryption available. Work to inform them on the dangers of corporate spying and profiling, as well as data leaks and security, and let them have some sovereignty over their platforms. Keeping an eye on them is good; isolating them from important modern social circles isn’t. Inform and educate first and foremost
In the GrapheneOS development room there’s a lot of talk about finding an OEM to get security partner status from and/or to design a grapheneos specific device. I saw they were tentatively chatting to the CEO of Mecha (currently crowdfunding for a Linux handheld called the comet) as well as another anonymous Android OEM lead. So I’d say be patient, wait and see. I’m confident the project will continue, hopefully with full support for pixels via a partnership but potentially on their own hardware.