4. I can recommend VSCodium. It is based on the open-sourced code of VSCode. On many distros you will find it in the default repositories.

You say that you want to do this for “privacy” and “security” reasons. Those two are not the same. What is the exact use-case which you want to prevent?

Disabling WebSockets will cause some Websites not to work properly anymore. Especially such which rely on live updates without reloading the site (most common use-case for WebSockets).

Imo debloating the apps itself is not possible. To do that, you would need to somehow decomplie them, change the code, repackage them and install them as custom applications. This might be possible in theory, but is not feasible in a real-world scenario.

I recommend the following two options:

1. Use different clients where possible. For youtube F-Droid has some alternatives. For reddit I don’t know the current status.
2. Use a VPN based solution such as AdAway. It can block requests based on target IP or Domain. But keep in mind that blocking certain requests can prevent the app from working.

For switzerland the “stem” type probably only applies to farmers nowadays. The others live in a more nuclear family. 100 years ago the graphic might have been applicable ;)