Sorry not to answer your question, but /e/OS is indeed not really behind in terms of security patches, for example the latest release (3.7) includes the April security patches

AOSP even without Google Play will still ping Google servers every now and then. Unless you're being targeted or installing apps of unknown provenance, the chance of being hacked due to the Calyx hiatus is still very low. But I think you'll need to reinstall from scratch once Calyx updates resume since their bootloader keys will be generated anew at that point. I'm biased towards fewer pings to Google over the latest in security, but that's just my own threat model.

Apologies if you've already seen it, here's the big table I consulted: https://eylenburg.github.io/android_comparison.htm

When CalyxOS went on their hiatus I decided to go with iodéOS. It's French based and while it has some paid for features it is features you wouldn't normally use in CalyxOS anyways so no loss for me.

The updates have been stable and good, lately however they pushed the update for the new Android version which require the bootloader to be unlocked so I have to wipe my phone sadly. But other than that they've been good until I can get CalyxOS going again.