See first paragraph again, not everybody is as affluent as you’re, look at the problem from the other perspective

There is no blanket advice for which device to use. You will have to look it up yourself. But if you’re using a phone beyond its supported time, then you are vulnerable.

will take control of the phone from the inside out, nothing will withstand that

Nothing can withstand a 0-day attack, but it’s on your manufacturer to prevent a 1460-day attack.

Pegasus will use 0day, nothing to do about that

See above statement.

Once somebody have physical access because you’re some POI and not an average Joe, not much you can do

You can be a random person walking in a busy metro area and happen to get in range of someone who is scanning for a particular device to use a side-channel attack on. You don’t have to be a POI.

See first paragraph, parenthesis content. Also phones are made with short lifespan on purpose, this gives steady inflow of money for the manufacturers, only few will give you what you want

The manufacturers are still responsible for patching their devices. Once they stop doing that, you should know that device can’t be trusted with your privacy and security. This is the minimum baseline standard. If you are trying to extend the life of a device by yourself, and use it as a daily driver, you have decided that your data is free for anyone to have.