There's no way to srsly prevent a full-bloat browser from messing with its environment. Make a static VM image and reboot it at the beginning of every session.
It's easier now that there are some control headers for it. At the time I tried a lot of things like bouncing through javascript opening a new window. Results varied by browser. The simplest way was to inconvenience users a bit by supplying text urls for them to paste into the nav bar, instead of clickable links.
I had some private pages a while back that linked to unrelated pages on other sites. I had to go somewhat crazy to stop the private urls from leaking to the external sites through referer headers when my users clicked on the links.
If chrome is sending people's browser histories to Google that is invasive.
What does that even mean? But yes lots of us run Linux on servers. Just ssh in. Or even just wipe the VM and launch a new one if you want to upgrade.
A classic. Klaatu barada necktie!
You can get right angle 3.5mm connectors that help with the cable durability, but yeah, serious full sized wired cans use 1/4" or XLR connectors still, I think. There are some lightweight bluetooth headphones that might not be BIFL but could hold up pretty well, especially compared to those silly airpod-like buds. You probably have more experience with those than I do though.
Oh I see. The Sansa Clip is an old school device where you transfer files by USB. There are certainly Android phones with 3.5mm jacks though.
There are what I'd call BIFL blueotooth headphones but they are full sized cans, not earbuds. I wouldn't want to ride a bike wearing them.
SanDisk Sansa Clip is the size of a matchbook. Not fancy but not a brick. Get the model with the micro SD slot and you have unlimited storage. With Rockbox it might even support sdxc so you can use a 2tb card. Otherwise 32gb limit.
It still has an internal battery (I hate those) but people have managed to replace it.
Use wired earbuds and a player with a 3.5mm jack. BIFL for that stuff is kind of difficult though. Just buy cheap and replace now and then.
Tools:preferences, about:config, file downloads, form prefills, remember password, etc. yes you can try to lock everything but it's too easy to miss something. And then there are outright RCEs. There's just too much attack surface.