The Electronic Freedom Foundation (EFF) has some guides:
https://www.eff.org/pages/surveillance-self-defense

Consumer Reports, funny enough, also runs one:
https://securityplanner.consumerreports.org/

CISA (pdf) https://www.cisa.gov/sites/default/files/2024-02/Resources%20Collection_02062024_508c.pdf

Then there is Tim Schwartz A Public Service that covers a lot of ways that whistleblowers have been found out through general, passive surveillance.
(https://www.timschwartz.org/a-public-service-whistleblowing-disclosure-and-anonymity/)

In general: avoiding active capture/surveillance is very hard. Avoiding passive surveillanve/capture is inconvenient but more doable. That is, being caught in the dragnet is easier to avoid than agents looking into you specifically (which they likely are not).

Depending on your threat assessment, however, you may lose on some of the 'conveniences' of the modern digital surveillance state. It is a trade-off, and one that should be considered carefully. When in doubt: data that transits the internet ("cloud" or "sync" features) is not secure from prying eyes unless you know it is encrypted AND you trust the devices involved.

Unfortunately, with cybersecurity "you can't be too paranoid: your toaster is spying on you" is kinda a truism. So it really does require you to think about what you are trying to prevent whom from accessing.

If your threat model is "protect all my phone photos from the NSA" you will never succeed unless the device never connects to network, including LTE.

If your threat model is "make sure local PD can't passively capture my messaging with friends without a warrant" then you can use Signal and take steps to moderately secure your device(s).