It seems that GrapheneOS is making releases for Pixel phones, including the 4a which include patches for the webp exploit: https://grapheneos.org/releases#2023091800