The only thing I can think of is to make a full backup of /system, /data (and /sdcard) with something like TWRP, move it to a small, encrypted usb drive (bonus

The only thing I can think of is to make a full backup of /system, /data (and /sdcard) with something like TWRP, move it to a small, encrypted usb drive (bonus points if the partition on the drive is hidden and there's a legit partition as a decoy). Then you just have to restore from your backup, which you would already have locally. Save the backup elsewhere before you leave home if you don't want to lose everything if the usb drive is lost. That is all a major pain in the ass and, as others have pointed out here, those that want to do harm are likely already doing this. I wouldn't expect normal folks to be able to do this, nor should they have to in order to preserve privacy.