Because you can check the sources from a git and the install a package that you don't know how they got built.

That's a chain of trust, I trust Florian hence its reviews hence Teleports, I trust UBports hence the open store, so I trust the click package delivered by the open store for Teleports.

You are right to point out that the open store doesn't make all apps safe. But if you know and trust the source and if you trust the platform, then you can relax.

The open store is managed by the UBports foundation so you can trust it to install your click packages.

This is not good advise. Anyone can upload apps to the open-store and the confined apps are only getting a very basic automatic check. As for the unconfined ones, yes they seem to get checked manually by foundation members, but they are also much more risky to install.

I don't want to spread FUD, and so far all apps I tried from the open-store seemed fine, but this kind of app distribution model is inherently untrustworthy (like the Playstore and the iOS appstore as well) and people should be cautious what apps they install from such a channel.

About the phone, I don't know.
I have a Nexus 5 and a Pinephone.
The Pinephone is not yet completely ready but if you can wait that's a good option.

And I decided to order a F(x)tec Pro1-X with Ubuntu Touch on Indiegogo.
It's pricy, but I miss so much the physical keyboard. And I was curious how the fingerprint reader can work on UT.

You can technically install Firefox, but the UI is not adapted to mobile.
The best experience will still be with Morph IMO.

Yes, you'll have to trust UT and Teleports, but given that it's open sourced, it means you can check for any malware. But if you trust this community than there is no need to worry. The lead developer of Teleports is one of the core team, every PR is reviewed.
The open store is managed by the UBports foundation so you can trust it to install your click packages.

1.what phone have, at your opinion, most ready to use UBports, if not Nexus 5, and still easy to buy ?(less bugs, more compatibility)?

2. will i able to install another browser (firefox, vivaldi)?

3. extremely paranoiac question, why should I trust my login and password from telegramm to third-party application? Because it open source? Because if i trust to install UBports, i should trust to use Teleports ?

SMS, calls are working very well.
Few hicups with MMS sometimes (but not often from what I experienced).
I also use Teleports (Telegram) which brings modern messenger to UT and Axolotl (Signal - but there are less users in my contacts).

There are very nice navigators (PureMaps and uNav).

The browser, Morph, is very nice to use and webapps are really useful for privacy and frequently used websites.
I don't have major issues with the browser, but it will depend on the websites you're using.
But Morph improves quickly.

I think you migh enjoy your experience with UT.
It's far from perfect, but I have no major issue with it.

It's been 3 years now without any android phone.

Many are webapp (a confined app accessing a unique website ; you can see that as a shortcut but it's much more), but there are also very nice native apps.

You can also install "legacy" apps from arm debian within Libertine.
Libertine is a container available for this purpose but you might have trouble with some apps.

Then you have the most experimental feature: Anbox.
Anbox will allow you ton install APK but don't expect a full support.
Apps using Anbox will have only access to the network and all access to media files, contacts, ... won't work.

You can find more information regarding Anbox and Libertine on the forum.

1. but will I able to use Linux applications only? (without any apk, java, etc.) I mean, what I need is browsing, phone, and sms.

2. can I install any application that work with arm debian Linux, or i have to only applications that on UBports repository ?

But they don't add any of google's services, play store or anything of sort.

IMHO AOSP is pretty safe on the privacy front. But I don't like the Java built apps, the APK system and all the memory space lost to the app.
I also prefer confined apps for privacy.

Even more precise look here : https://halium.org/
There is a graphcal i knew i saw somewhere (probably on this very site lol) and wanted to show you, it makes easy to understend.

With a halium build, we remove the top layer known as android, and replace it with UT (or another system such as Lune). Because the android drivers are proprietary, UT must keep the middle layer to interact with the hardware. But, that middle layer is locked down and cannot be altered by a virus. I guess theoretically someone could write a linux exploit that could somehow mess with the hardware driver layer, but it would have to be a linux virus because what you know of as android is no longer present.

The Pinephone does not require that middle layer, because all the parts are as open sourced as possible and linux drivers are available. So the UI can talk to the hardware directly. It's weak spot is the modem, which is proprietary, but is well isolated from the rest of the hardware. Both devices could be compromised by a linux virus, the chance of that happening though a linux security type will need to answer.

See here : http://docs.ubports.com/fr/latest/systemdev/kernel-hal.html

Only "android" part on any android device port should be HAL.

1. Do i understand correct, if someone can hack Android 7, it can get access to my UBport Nexus 5 ? Or because android files is read-only it impossible?
2. If some malware/virus could work on Android 7, it could work theoretically it could work on Ubports ? For example, malware that making backdoor to your microphone? i don't know if it does exist, it just for example

Yes basically it is that, and on pinephone linux kernel is "pure" and drivers open source.

so actually Nexus 5 Ubports it is still Android

No it is not, as i understood it only use the linux kernel from android for a given phone as it contains closed source drivers (blobs) from manufacturers to run phone hardware, but i'll not explain further because i may tell something not accurate enough.
Wait for a ubport dev to answer exactly how it works in details.

so actually Nexus 5 Ubports it is still Android 7? Does Ubports on Nexus 5 still have same security problems, as Android 7 ?

Which is safer, halium builds vs pinephone?, i'll let the developers weigh in on that.