Since I need to run a few apps that won't work on LineageOS (because dumb developer security stance), I need to buy a "regular" android device that includes all the google "services".
Ideally, it should be a cheap second-hand phone that will still receive security updates for a long time.
Are there bands that are better (well, "less worse") than others from a privacy perspective?
I definitely second this. From what I've read, graphene's sandboxed google services work a little more seamlessly compared to microg.
Edit: you might want to be careful with secondhand, though, regarding locked bootloaders. An unlocked bootloader is necessary and is NOT the same as "carrier unlocked"
I had bad luck and ended up with a Pixel 2 that was carrier unlocked, appeared to have an unlocked bootloader but was some special Verizon version that did not allow flashing. Fuck you, Verizon.
Yuuup, Verizon is exactly what I was getting at lol. They seem to be the most common refurb/second hand devices.