Helpmeeee Google has committed to fix firmware bugs and Android security bugs for the 5a through August 1, but has not committed to doing so after that.
Once Google stops supporting a device's firmware, it is no longer a secure platform for GrapheneOS, and GrapheneOS support will taper off. Depending on one's security stance, it may make sense to stop using the device some time between August and the end of 2024.
It is unfortunate that at present working devices have security expiration dates, but that is the situation. One piece of good news is that newer Pixel devices have much longer firmware lifetimes.