To get Android into a fully patched state, you need both firmware updates that come from your phone’s vendor, as well as OS patches that come from your OS developer (in this case GrapheneOS). GrapheneOS usually only provides OS updates as long as Google provides firmware updates, because they don’t want people to run outdated and potentially insecure devices with old, unpatched firmware. But they have extended update cycles for some EOL devices like the Pixel 4a (5G) and Pixel 5.
To get Android into a fully patched state, you need both firmware updates that come from your phone’s vendor, as well as OS patches that come from your OS developer (in this case GrapheneOS). GrapheneOS usually only provides OS updates as long as Google provides firmware updates, because they don’t want people to run outdated and potentially insecure devices with old, unpatched firmware. But they have extended update cycles for some EOL devices like the Pixel 4a (5G) and Pixel 5.