You’re not getting the updated proprietary blobs for the chips.
You’re just getting an updated OS.
You’re just getting an updated OS.
Which is where most security issues are found and/or mitigated.
Unless a hacker has physical possession of the device, access to these blobs generally runs through the OS.
Facebook isn't going to deploy malware to my phone using Whatsapp, MS isn't going to do that using Outlook, Google isn't going to do that through Google Maps. Everything I used is either by a reputable developer, or open-source from F-Droid.
The only way I'm getting malware is if they manage to: 1) exploit a bug in my up-to-date web browser, 2) bug #1 is used to exploit a bug in the hardware driver. Oh, and of course, since I only visit reputable sites, I'm never exposed to malware. I'd have better odds of winning the lottery.