No security fixes once the device reaches end of life. For pixel 4a end of security updates was 10 months ago. That mostly is a problem with malicious apps - there were some privilege escalation bugs in those 10 months - but sometimes you get a banger that can get exploited by simply loading a page or opening an image.
If you are on stock software on EOL device you are not getting os updates either.
Also a bunch of recent vulns were in SoC specific stuff - outside os.