Even if Lineage will sort out the 19.1 (when?), you can choose divest OS Mobile. The xa2 is listed there and people are using it with divest. Nobody is forced to choose another device, and nobody has to stop using the xa2 when there are no more security updates for our device. Unfortunately divest os is not well known like iodeOS/etc/etc. I use divest with my nexus 7 wifi (2013) and appreciate it very much; privacy and security is highly considered. Every month you get still a security update and CVE´s are fixed. But again: without the work of LUK1337 that would not be possible for the xa2 and I still enjoy and appreciate LUKs lineage 19 on my phone.