csis01 If a device is not receiving extended support releases from GrapheneOS, it doesn't even get the AOSP patches anymore. In those cases, something like DivestOS may be a better choice.
With that said, we need to be clear about what using an EOL device entails. They are insecure, plain and simple. We should under no circumstances be recommending that people buy already EOL devices or somehow insinuate that just because you're installing GrapheneOS you're somehow way better off.