As an owner of a 4a, I can tell you with confidence that my device has not received an update in any form for many, many months now. It is effectively unsupported, and certainly is insecure in comparison to a Pixel 6 or newer.

The GrapheneOS developers themselves have stated in their forum that they will no longer provide extended support beyond the Pixel 5a, and that the extended support it has is already effectively insecure:

You should already be treating it as if it's not receiving updates anymore, since that's largely the case already.

Providing extended support doesn't fit with the way we do things at all and is ending after the Pixel 5a. It's a temporary compromise for harm reduction through existing users at least getting some of the patches despite not moving to a secure device. When this topic comes up in this way, it hints to us that we may be doing more harm than good through people continuing to use an insecure devices. We'll certainly stop doing it with the 5 and 7 year support devices.

A day ago, a GrapheneOS dev said of the Pixel 4a:

It's unsafe to continue using the Pixel 4a. It lacks basic security updates. Pixel 4a was launched August 2020 so it's at the 5 year point. It was a budget device, not a flagship. It was launched with 3 years of support, unlike 8th/9th gen Pixels with 7 years of support from launch or the prior 6th/7th gen Pixels with 5 years of support from launch.

So for the Pixel 4, it effectively received about an extra year and half of tenuous support. The Pixel 5 will receive a few more months of tenuous extended support, then there will be no extended support for any future devices, meaning users will have to upgrade at the end of Google's official support cycle for each device.