The operating system is not the only way of spying, there is already firmware on your device running without your permission, pretty much impossible to see what code its running, and requires expert level knowledge to disable (or tamper with :)) if a third-party firmware implementation that allows disabling the IME doesn't support your device.
Most phones today also just have a non-unlockable bootloader with a spyware Android skin installed. Locking something down to this level is not really impossible.
Your browser clock is not off. LibreWolf, Tor Browser, Mullvad Browser etc. set your browser's reported timezone to GMT to not reveal which timezone you're actually in.
And I don't understand what you're talking about in the last sentence.