Both of your arguments are pseudo-arguments:
If you have a broken part, you replace it, even if the replacement might also be broken in a way unknown yet. So yes, updates can introduce new vulnerabilities. But the parts they replace are known to have vulnerabilities. So you are improving the security of the device. (But I do not think that this has to be reiterated. I think everyone should know by now that using up-to-date software is one of the easiest and most effective ways of improving online security. And coincidentally, “hacks” using open vulnerabilities in private devices has gone down as automatic updates became standard.)
Also, the vulnerabilities the updates address are present in all Android devices of that version, not only /e/OS or a specific model. Thus, the set of /e/-users is just an arbitrary small subset of Android-users of a specific version and thus it is less likely for their devices to be hacked than for those of a larger subset – but not less likely than for any other subset of the same size. So even if no /e/-user had been hacked (which you cannot know because they, the user, would not necessarily announce that publically) your argument would only state that probably there are not many /e/-users, or, that timely Android updates are indeed vital for secure devices.
But I am not here to discuss the merits of IT-security but rather to know whether I have to start fiddling with my phone (to upgrade to the dev channel) after only two years which is exactly what I wanted to avoid by buying a phone that was praised by Murena as being supported for a long time.
So, @Manoj, what are the plans for the Samsung Galaxy S9+ bought at Murena?