Being reliant on a single OS permanently nailed to the hardware is no less crazier. I'd like to be able to install another OS on a vulnerable device, it would help tremendously and not only with the security of that specific device.
Now I've got some expensive paperweights that I can't even use as such because every time I see them I have the urge to throw them in the trash can.
Provide a way to unlock the phones and a standard BSP, it should be the law.
LineageOS has a build roster of current devices at this URL:
https://lineageos.org/Changelog-30/
The Pixels are the most flexible, but don't buy a model from Verizon (they don't allow unlocked bootloaders).
Most other OEMs require you to generate an unlock token and send it to them, then wait a week, which is extrememly inconvenient (and sometimes they just stop and refuse, as I understand OnePlus has).
If you want a locked bootloader at the end of the process for security, then you will be on a later Pixel with Graphene.
I understand that most U.S. banking apps work on Graphene.
As far as contactless payments, try a Pixel watch. I understand that it is entirely separate from the phone.
However, Google Pay will certainly run on my Lineage OnePlus 5. It will not provision localhost, but I am guessing that it will provision a watch.
I would go buy the parts and try it just to know, but I doubt interest would remain here by the time I assembled everything.
Edit: Graphene has a page on this subject, and Garmin appears to be the best option.
https://discuss.grapheneos.org/d/1040-compatibility-with-sma...