Not sure if VPN eliminates all risks with 2G and 3G, maybe it does.

It doesn't, but probably even on modern phones it only does if you explicitly set it to only use 4G but nothing below that.

Mull has no process isolation at all, but support for UBO and Noscript. Bad situation

If you only visit known reputable websites it's probably not really a problem, but also, I think there are chromium browsers that have addons. Not sure though if there's one that besides that also has the security patches.

These cannot be written without TPM verification or stuff

I doubt that it couldn't be written, I believe TPM can only verify its contents and make the phone refuse to boot if it doesn't agree on the authenticity of the partition contents.
However it's also a question which partitions are checked that way: only the system partition? Or more? Probably not all, because they can't verify e.g. the main user data partition, because it's ever changing contents were never signed by the manufacturer. There's a few dozens of partitions usually so this is not trivial to answer.

the verification will not be done inside the OS, that would be totally flawed.

Yes, verification is done by one of the bootloaders. At least partly, the OS and maybe other layers must be doing it too, just remember why Magisk had a feature to hide it's processes and the controlling app itself from select system services and other apps.

Reading data has nothing to do with that. They likely can, but that doesnt matter.

Didn't mean that. I meant writing data that is later being read by other important system software that is vulnerable to specially crafted quirks in that data.