Please note that I don't speak for the GrapheneOS developers. Also, I'm not adept enough with the AOSP ecosystem, including various nested repositories, to start with the release changelog page and confidently tell you exactly which changes a Pixel 4 XL is getting. So if I really wanted to know, what I would do is follow the directions for building GrapheneOS for the Pixel XL, with two different published release tags, and then I would diff the sources. With that said...
Some changes happen in actual apps, e.g., Vanadium. I think a Pixel 4 XL is still getting new Vanadium releases via the Apps app. A lot of other changes happen in "regular user-space code", e.g. Java or Kotlin code. I think storage scopes happened at that level. I believe code like that is all still being updated out to a Pixel 4 XL.
But I think it's important to keep in mind:
- Changes for a Pixel 4 XL are expected to stop -- pretty soon. For example, I believe that the first GrapheneOS based on the next Android version is expected to drop the Pixel 4 XL.
- GrapheneOS changes might stop before they are expected to. It might turn out for some surprising reason that something can't easily be shipped to the Pixel 4 XL, in which case it's plausible that nothing would be. Maybe some seemingly-innocuous change to an app would tickle a bug in the GPU firmware for the 4 XL. Might the developers carefully diagnose and separate out that one change? Sure, maybe, but also maybe not. So, on a surprise basis, any release of GrapheneOS might turn out to be the first release that drops some device.
- Meanwhile, a bad firmware bug might be discovered -- but never patched -- literally on any day.
Overall, I'd say that once a device hits extended support for GrapheneOS it's probably prudent to decide -- at that point -- on one's next device, and place an order for it, if one hasn't already, because the security of that extended-support device has already at that point seen a probabilistic but very real risk increase.
In other words, I think the extended-support window might be best viewed as a "grace period" in which to decide on a new device, order it, wait for delivery, install GrapheneOS on it, and migrate one's data (which can take a while). I think if one does that then the likelihood of a catastrophic firmware hole being found during the grace period is low.
I don't like dumping a device that is still operating (especially if that device has desirable features, e.g., a headphone jack). But running an OS with extra security is likely to cost something, and dumping a device some months early is probably one of those costs.