Sadly the Pixel 3 is no longer getting security updates. Which custom ROMs mitigate a bit. But graphene OS has stopped supporting it. So if you're very security sensitive you probably want to stick with a phone that's still getting updates. That being said I love my Pixel 3A. Just sad it's not " safe anymore "
The e-waste treadmill of phones is really disappointing. I would love for a legislator to come along perhaps the EU, and say if you stop releasing security updates you must open source the drivers. So the community can take over