Install canta then you can remove hidden telemetry apps they have badges for which are safe to delete and which are not
I have a friend who wants to get more privacy aware but is not yet ready to commit to a new ROM based solution
I’m with IceFoxX on this issue. Your friend isn't aware how Google's ROM bypasses whatever privacy setting you made because it's their entire business model to invade your privacy. You're better off installing the full ROM instead and working backwards on what the friend wants to divulge.
Techlore has a video on Android hardening, worth a view. There are definitely possible steps to take beyond the scope of this video, but its a good place to start.
I am also using a rom so i cant help with apps & stuff
I use the lineage based e/os. Booth are degoogled and suited for like 13+ year old devices (except apple) so if you manage to find an old phone you can test it out without tampering with his currenw phone
Random Stuff:
F-Droid is for open source apps
Ensuring a not google email
You can check/look for new apps here but its not really made to look for categories like games
EDIT: reports.exodus-privacy.eu.org/