That is correct, in that case you need to encrypt either the files you want to be safe, or use full-disk encryption. I have no idea whether Purism will support

That is correct, in that case you need to encrypt either the files you want to be safe, or use full-disk encryption. I have no idea whether Purism will support selective file encryption or FDE out of the box, but it'd be pretty cool if they did. That said, under the hood your phone is basically a Linux device, so doing this yourself might need some basic know-how of Linux administration, but shouldn't be too hard (regarding file encryption, FDE may be trickier).