I agree with you practically except that the pixel 3a has not been getting security updates for over a year.

I wouldn't run it with anything personal on it.

- https://endoflife.date/pixel

I use a Pixel 5a with GrapheneOS with full storage encryption and even when it stops getting updates no matter the security situation I don't plan on upgrading at all if ever, I already don't want any banking or authentication to rely on a phone so that's not a big issue. Of course I still have machines at home running Windows XP (updated to 2019 albeit) so do not listen to me on security.

Windows XP airgapped should be OK.

Contrary to seemingly everyone here I'm not exposed to state level threats so I couldn't care less, as long as Google maps give me my direction and Spotify plays my song I'm ok

On the stock firmware, sure, but lineage OS doesn't have that problem

Great, so your security situatuon is now determined by two contributors that haven't moved on back-porting userspace lineageos to your device.

I very much doubt anyone is making kernel or vendor updates to upstream neglected components.

See https://grapheneos.org/faq#legacy-devices