Your best bet might be one of the Pixel "a" series, which are Google's budget-oriented models. Stock vanilla Android with as little bloat as you can hope for.
Those Pixels have options to open bootloader and after flashing custom ROM that is much cleaner (GrapheneOS) to lock it again. Which is currently most secure way to have clean and secure android device.
