Is disabling apps on Android secure

What I mean is this: I currently have a Samsung phone, I will probably get a Pixel once Pixel 9 releases and then I’ll install GOS. Since there is a lot of bloat from Google and Samsung, and not everything can be uninstalled, I disabled quite a number of things which are of no use to me by using the settings (not adb).

I was wondering whether this is secure as disabled apps do not receive updates from the Play Store (or Galaxy Store for Samsung apps). Could an attacker theoretically access them in some way even though they are disabled? Would it then be safer to keep them enabled and updated, but to remove permissions and hide the icons (for those that have them)?

If you leave them disabled you have nothing to worry about. The apps operate within SELinux so if you keep them disabled it is practically equal to “they don’t exist”.

Now if for some reason want to keep them updated, just create a new separate user profile and update them from there occasionally.