I agree with you practically except that the pixel 3a has not been getting security updates for over a year.
I wouldn't run it with anything personal on it.
I wouldn't run it with anything personal on it.
I very much doubt anyone is making kernel or vendor updates to upstream neglected components.