I wonder if I need a separate burner for each suspicious app.
That’s going pretty far overboard. Just use an app like island to forcibly isolate and stop the app from running when you don’t want it.
This is a pretty good answer. https://android.stackexchange.com/questions/241281/how-exactly-do-apps-not-running-in-the-background-receive-notifications
I think you need to find a different ear tip my dude. Unless I’m doing something extreme I’ve never had them just fall out. I’ve had 30+ seconds of warning that they’re slipping out of my ear before they’d fall out, but almost never just “whoops I’m free”.