Why not? I'm running vanilla AOSP with F-Droid apps only. No Google Apps framework.
Threats are limited then to regular baseband radio issues. I know I could be doing better if we had open hardware, but that's the most practical solution I can implement today I think.