jerryfog500 My sense is that for the first month or two the stale GrapheneOS might be better, because GrapheneOS is aggressive about getting patches out. Thereafter a fresh DivestOS might be better.
However, after GrapheneOS support ends, it is not prudent to rely on the device to be secure (it may be OK to use it as an alarm clock, music player, game platform, etc., especially if you isolate the device on a different Wi-Fi network from higher-security devices).
It is unfortunate that working hardware such as your 3a can't remain in use for secure applications, but that's the situation. The good news is that Google has been extending support times for newer devices, so this situation should happen less over time.