I've been using third party ROMs on Pixel 3. They receive monthly security updates to some extent, but obviously the hardware specific "vendor binaries" are still outdated. Frankly, I cared more about the open nature of the ROM than about security/privacy. These days, I assume all my data is available for sale everywhere anyways.