I'm still on pixel 3a with andoid 12 and last security update was May 2022.

Is it really risky to use this phone? What if I avoid random apks from internet and ONLY download from the Google Play store?

I ask because pixel 9a is on sale in Canada rn. PSA to those with pixel 6a, you can get an additional $150 USD of Google credit if your 6a qualifies for the batter reimbursement