I haven’t done much reading into it, but something to consider is there was a post just recently that I saw someone mentioning that their pixel 4a was becoming unsupported very shortly. You may want to see when the scheduled EOL for the 5 is as that might influence your decision if that is sooner than you’d be hoping for.
To expand on the points mentioned above as well, although you may not be concerned by someone tracking your phone, something like root access is a concern. When the other commenter mentioned someone having access to your phone, it doesn’t mean unlocking the screen and moving it around, it means they have the ability to run commands at the highest privilege level at which point, an attacker can do basically anything.
Find ways to export biometrics? Idk, probably, set it up to forward all requests to a man in the middle server? Almost certainly.
To say “if I can’t see it, it can’t be compromised” is definitely a naïve stance in my opinion. Whether this is being done intentionally by companies to sell more phones? Well… I don’t think many people would argue the contrary