We strongly suggest upgrading to a new device as they become unsupported. This is because you can't get firmware upgrades by the OEM and therefore miss patches. We keep devices supported until the next OS version for harm reduction so users have time and comfort intended to upgrade. Pixel 6a is the cheapest supported option, but Pixel 8 and above have the best security thanks to hardware memory tagging support.

In the case of the recent exploit, this exploited firmware. Even if the OS provided a countermeasure - it would never be fixed on the firmware side for an older device. These companies also trivially talk about breaking into these older, unsupported devices easily. Even if a fix came for a 4a, you have no guarantee for the next.

If for whatever reason you can't upgrade device, DivestOS is a good choice for that once GrapheneOS stops updating.