Likely needs to be done in multiple phases:

First add safe types to 3.x to minimise the future diff between versions:

• [3.x] refactor: Add initial backwards-compatible return types #1763 to add return types to final / private classes & methods based on static analysis in 3.x (these are BC as the methods cannot be extended)
• [3.x] refactor: Add more BC types to method returns and private properties #1779 to add further strict return types (as well as some property types)
• add parameter types to private methods based on static analysis in 3.x (these are BC because we know all the possible call sites and the static analyser can detect exactly what types are actually ever passed).
• MAYBE add parameter types to public methods based on static analysis in 3.x if they match the phpdoc. Theoretically these are BC if we believe that the phpdoc provides an external contract. However they could cause a BC break if people are calling with declare(strict_types=1) and have previously relied on us typecasting internally. We have accepted this in the past, but the risk of doing lots at once might outweigh the benefit of getting this into 3.x

Then add merge up to 4.x and add remaining types:

• Potentially first using ingenerator/risky-rector-rules to generate strict types for all interfaces from their phpdoc. Rector produces different results when the interface has strict types, so we need to update them first.
• Then use Rector to add types for all classes / methods based on static analysis
• Then use ingenerator/risky-rector-rules to convert remaining phpdoc types into strict types.