If you get a Pixel phone and put GrapheneOS on it, you're actually ahead on OS updates compared to vanilla AOSP. For example, the webp vulnerability was backported 4 days ago, while regular Android users will have to wait until October to get a fix for this vulnerability.

(Of course, the thing about the baseband still remains, but Google now offers 5 years of security updates, which are immediately ported by GrapheneOS.)