No security fixes once the device reaches end of life. For pixel 4a end of security updates was 10 months ago.
That mostly is a problem with malicious apps - there were some privilege escalation bugs in those 10 months - but sometimes you get a banger that can get exploited by simply loading a page or opening an image.