Most people here seem to be thinking there are state level actors going after them, utilizing zero day exploits and some top tier hacking techniques. Forget about this stuff and focus on the basics that is frequently overlooked and easy to make a mistake over a longer period of time. Following a strict protocol is harder than it may seem.
Use a PIN/password. Never use a thumb print or face id or anything you can't take the fifth on.
Set aggressive locking timeouts, enable device wipe after unsuccessful PIN attempts. No online recovery methods.
Your business phone must be a burner, its purchase must be anonymous and can't be tracked to you. (no online purchases, buy in a pawn shop and pay cash. Do not use large denominations from an ATM, break them first.)
Never ever cross SIM from personal and business devices.
Turn your business phone only when it's required, then turn it off.
Do not turn your business phone at home or where you can be identified.
Do not carry your business and personal phone both turned on at the same time. Location and path patterns over time will tie them together.
Understand IMSI and IMEI. Every phone has an identifier (IMEI). Just getting new SIM is not enough, you can be tracked using IMEI over time and your previous phone numbers can be found and your network of contacts can be identified. Get new burner phone for every new big project (as a physical device) and destroy the old one. Destroy, not sell.
Use multiple physical devices to split networks and keep activities and associates isolated.
Use cellular data for Internet access, never home wifi. Disable wifi if you need to use the phone in range of your home wifi.
Do not use public wifi in places under video surveillance.
These are the baseline rules. If you don't follow them then there's no OS or VPN or anything that can protect you.