Comment by kornhole

As long as you keep device in your possession with a quick option to wipe it, I believe that mitigates the unlocked bootloader. Graphene locks the bootloader as a more secure option.

I tried Invizible Pro and do not see option for split tunnelling. I suppose Orbot may be a better choice if authentication to one of those services is needed.