Exactly! If security is your highest priority, buy a new Pixel and put GrapheneOS on it.

But if you have an EOL device, DivestOS seems to be an amazing alternative to just staying on the stock firmware that is not going to get any updates at all.