Of couse there's Replicant + F-Droid, and that sort of gets you where you're aiming for. Sort of.

Unfortunately, I think Replicant struggles because it gave up on the state of churn of Android to stay at a much older version. Thus, I'm not confident it's getting the security updates it needs.

Yet here I'm running an X200 machine that has been retrofitted and is running super up to date modern GNU/Linux software. The machine is like a decade old! Yet my phones and tablets, often it's very hard or impossible to get them to run any modern free OS. What's going on?

I think the root of it is governance. GNU/Linux systsems have community governance and update systems. On mobile systems, we're caught up between planned obselences devices on the manufacturer side and "thow code over the wall" on upstream Android...