Removing by ADB is fine if you are able to identify which packages should be removed or if they’re already covered by Universal Debloater. You should also use Invizible Pro to control what connections are made and block trackers.

Gboard isn’t open source, which is why I disable internet access for it.

It isn’t a system app for my phone, so maybe. You could still use something like InviziblePro or RethinkDNS to disable its internet access without root though.

I use Gboard but with internet access disabled for it. I haven’t found a comparable open source keyboard yet.

You can make stock Android much more private. Universal debloat tool + Invisible Pro - remove unnecessary apps, restrict internet access to only the apps you want to have internet access, add a tracker blocker list.