[Android Apps and Games] AnonVendetta:
Get rid of adoptable storage while you can, go back to what Android calls "portable storage".

Unfortunately LOS won't let you move apps to SD if you're not using AS. This is where Apps2SD etc come into play. I think pretty much all LOS/AOSP/CM based ROMs are like that these days. If it's a stock OEM ROM, you may or may not be able to move apps to SD without AS. Samsung is famous for not supporting AS in most of their firmwares, while still allowing apps to be moved to SD.

Deeper explanation of AS:

Android formats your SD, creates AS partitions, and encrypts them. If you choose not to migrate your data, the SD is still considered separate from internal storage. But once you choose to merge, your SD becomes the internal storage that you would normally have access to (usually at /sdcard/ or /storage/emulated/<User#Here>). Another part of the AS SD partition is designated for app storage, but the files there can't be accessed directly without root. Also, once merged, your internal storage becomes effectively managed/owned by Android. I don't recommend AS for devices that have more than 128GB internal storage, for the reason that you're kind of forfeiting control to at least a part of that storage. A selling point of AS is that it gives you more space for apps and data without having to manage seemingly separate internal/external storages. It just makes everything look like it's all in one place. If your device has a lot of space, AS isn't so useful.

As for whether apps are stored on the real internal storage (in the the data partition), or on the fake AS internal storage (on SD), that's also managed by Android. You can still manually choose to move certain apps back and forth as you wish.

In short, Android takes control of your data partition and allocates a certain portion to you via AS, all the while making it look like your AS SD is internal when it's not. The finer details are managed invisibly in the background. AS is designed to be user friendly ("for dummies"), but I'm a geek and prefer a higher level of control. I feel that AS is less suitable for that than regular portable storage.

As far as the encryption benefits, it also has a slight performance hit. Apps ran from the AS SD will never run as fast as they would if they were located on the "real" (data partition) internal storage. By choosing to move an app to SD, you're selecting the AS SD, and moving to internal puts it back on the real internal storage. But anyway, back to encryption....any attacker with access to that golden key file (via root or TWRP, since there's no other feasible way to get at it without elevated rights) will just be able to unlock your AS SD and they have everything. They can even plug the SD into a PC running Linux, and use the key file to unlock and mount the partitions.

I think Android encryption mechanisms are highly overrated, and they have been demonstrated to have numerous security flaws that makes it easy for an attacker to bypass and have your data. I never store truly critical files on my phone (the ones I wouldn't want anyone seeing), just the stuff I wouldn't care if they got to. As an alternative, you could individually encrypt your important files with (preferably open source) software. Or you could store them in encrypted container files like what EDS (app) can create. Then you would still have the benefit of encryption, and it would be more fine grained, instead of having the entire data partition/AS SD encrypted. Even if an attacker got to these files, they wouldn't be able to use them without either knowing the password, or cracking it via brute force.

I find that encryption methods/softwares on PC are much more reliable and secure than Android's encryption mechanisms. I'm actually very much pro-encryption and use it alot. But I don't like the ways that Android implements it. On PC, most of my partitions are encrypted, except those that shouldn't be for various reasons.

It looks like you already have a good backup plan, not much to say there. So you already know that AS cant be normally accessed on PC without using Android as a go-between. It's also smart that you cloning the entire SD in raw mode. That way it doesn't matter if it's encrypted or not. I'm assuming you're aware of command line tools like dd that can copy in raw mode. A downside of raw mode copying is that it can take a long time to backup/restore.

So, to end this post:

1. Continue using AS just as you are now

2. Continue using AS, but use it in "mixed mode" instead. By default AS will format the entire SD. With mixed mode you can create a 1st portable partition that is clear/plaintext. And another that AS will use for app/fake internal storage. This setup is almost the same as AS in regular/non mixed mode, but it gives you an extra partition that isn't encrypted. You can use the unencrypted partition for regular file storage, while letting AS use the other partition for apps. And of course the AS partition will also have its' fake internal storage you can use for storage too. A downside of this is that you might encounter the issue of only being able to access the portable partition in TWRP, while not having access to the AS storage. Or at least, that's what happened when I tried mixed mode on my older phone. For more info Google "adoptable storage mixed lidicott". You will find a blog post detailing how to create AS partitions in mixed mode.

3. Go back to regular portable storage. For this I'd recommend a 1st partition that is either formatted as exFAT (if you need to store files larger than 4GB, or if the partition will be bigger than 32GB) or FAT32 (less ideal). For the 2nd partition, it should ideally either be formatted as ext4 or f2fs (so that Apps2SD can use it for linking). Now you have the flexibility of app linking, while using fbind and XInternalSD to the fullest when necessary.

Another word about encryption: Physical access is king. If an attacker can physically access your devices, they have already done much of the effort required to get at your files. Never leave your device unattended, never let it out of your sight, never let anyone use it if you don't know them very well. And if you're not using it for an extended period, turn it off if feasible. I'm extremely paranoid in regards to who gets to access my device, I oftentimes won't even let my girlfriend use certain devices. Or if I do, I give access to a clean, sanitized "safe area" where nothing important is stored and they have extremely limited abilities in terms of what they can access. Or I will designate a certain device as "for use by others", unencrypted and with nothing important on it. These days an attacker with high level access can just access the powered on device, dump the contents of your RAM while the encrypted partitions are mounted. Then they take the RAM dump and analyze it for encryption passwords, keyfiles, or anything else that the encrypted partition may have temp-stored in RAM. An attacker can also do a so called "cold boot" attack. In this scenario they get accessible to the device shortly after it's powered off. They then have a time limited window (usually less than 5 minutes) in which to access the RAM and dump a copy. RAM still retains its' contents for a short time after power off before being fully flushed. Obviously these methods won't work everywhere, there are different types of encryption. And none of this will stop an attacker if they can establish remote access to your device while it's on.