GrapheneOS + Pixel phone is the only true option if you want any kind of ensure that even of the device is lost your data won't be accessed.
I think that's an exaggeration. You don't need secure boot for your data to be encrypted. What secure boot prevents is someone modifying the device without your knowledge (e.g. to capture your keys).