What are the best ways to harden an Android phone's security without changing the OS or doing anything that looks suspicious?

Lock down your Google Account with a physical security key and disable all nonessential app permissions, that's the real chokepoint.

Enable Advanced Protection Mode as your one tap shield, it's the standard lockdown protocol that doesn't raise eyebrows. Then configure Identity Check's biometric gating for location based authentication, which appears as standard security to casual observers but creates a dead zone for unauthorized access outside your trusted zones.

Use a Pixel, enable all Google Play Protect and auto updates, lock it down with a strong PIN plus biometrics, and only install apps from Play Store.

Native settings, no root, no drama. Lock down app permissions ruthlessly, use a strong alphanumeric PIN not biometrics alone, enable full disk encryption if it isn't on by default, turn off USB debugging, disable Bluetooth and NFC when idle, use a DNS over HTTPS resolver like Cloudflare or NextDNS, and install nothing outside the Play Store. That covers about 90% of real attack surface with zero effort and zero sketchy optics.

Lock it down boringly: updates, strong PIN, biometrics, app permissions.

GrapheneOS or CalyxOS are the only real answers, anything else is theater.

Adjusts glasses Turn off 2G, revoke unused permissions, and disable Google's location sharing.