The 4a could stop receiving updates any day now because it’s minimum support lifecycle is due to end this month. GrapheneOS will only offer updates for phones still supported by Google, which means you could be on outdated security patches very quickly.

If you want to use GrapheneOS, a better choice (if you can afford it) would be to stretch to the 6a, because that was from the generation when Google started guaranteeing a minimum of 5 years of support. This means that the end of its minimum support lifecycle is 4 years from now so it will be secure for a lot longer.

Here is the GrapheneOS support chart for reference.

Alternatively, you could go with an alternative privacy based operating system like CalyxOS, iodéOS or even LineageOS as they all offer longer term support for the 4a and other older devices. You won’t get the additional firmware updates when manufacturer support runs out, but you will at least have recent Android security patches. There’s also DivestOS, but I haven’t used that myself so I can’t recommend it with the same confidence as the other three.