He have stepped down since march this year I believe. No need to trust , verify. He was a bit of a removed but that doesn't mean GOS is not trustworthy. Sandboxing on a separate profile ( truee separate which you only get on grapheneOS) combine with VPN , blocklist (VPN or DNS) and no gapps . Not that much. Especially if you run enterprise versions of apps. In EU it wouldn't be legal.

Depends on your leverage here. But best to change school policy here. In many countries it would not be possible to force people to install WhatsApp or other programs on personal devices. Otherwise they have their own software or use email. Another thing if they provide the hardware.