My understanding is that GOS relies on google for security updates (and sometimes the other way around, they've made some flaws known to google). I would trust them to be solid, at least until google drops the P6 security updates, go look up how many years that is. At worst, you can then use LineageOS or something if you need security, hopefully by then you're degoogled. GOS will still work, but to my knowledge, doesn't guarantee updates after google stops updating. It's about as good as you can expect from a ROM, I'm quite happy, personally.