Your system is fully updated from at least the kernel/initramfs and up. Next you're running a system that has additional security measures.

So this breaks down to: What is firmware and are you aware of any issues in it? If no then there's no reason to get a new phone.

I'm not aware of any firmware security issues for any Android phone assuming firmware is pbl, sbl, aboot, modem or on-chip and even if there was they would be hard to exploit given your up to date and hardened system, but that's all theoretical and also apply to any new phone you would purchase.

I’m experienced in the field of cyber security

So... go lookup the CVEs. Go have a look at what the actual threats against the old device are. What's the method of attack and do you care.

If you decide you're happy with the device. Then remember to keep going back and seeing if any new attacks against the device exist.

Whatever happens, we're not protected against 0day attacks (by their very nature).

I guess there is some reason to worry about "unknown" attacks against the device. But like 0day's, there's probably unknown attacks against patched devices as well.

fwiw, the latest pixels have 7 years of support which should be long enough to cover the phone till it breaks. But yeah, I'm with you about the e-waste, it's awful for the environment to have to throw away a perfectly usable phone because of a lack of security updates.

I'm experienced in the field of cyber security and I feel like I'm in denial because I really really don't want to buy a new phone.

Then you know the answer already. Bite the bullet.

I think you'll be fine as long as CalyxOS is supplying your device with Android security updates. As an average user, with no reason to be the subject of targeted attacks, firmware vulnerabilities are not a huge concern (assuming your OS and other software are up to date with security patches).

Of course, if someone hostile gets physical access to your device, firmware becomes more important. Remote exploitation of a firmware vulnerability typically requires first exploiting a software vulnerability (and CalyxOS is updating your OS software). With physical access, one might skip that step by connecting a cable to your phone and interacting with it directly.