That seems far from minimal. A bare metal virtualisation manager like promox should fit the job much better with no actual overhead.

They are the only ones supporting several hardware based security features.

Only Google Phones are compatible with gOS. I’d recommend getting a different phone the next time. Xiaomi is a shitty company doing their best at sourcing their resources for the hardware the worst way possible. And they are a privacy nightmare.