As being stuck on an old security patch level for some time every ~3 years seems to be unavoidable if one wants to use COS on the latest Pixel, are there perhaps plans to keep providing updates to the built-in apps such as Chromium during the period from the official EOL of the oldest Pixel device up to the COS release of the latest one?

There won't be post-EOL extended support for Nexus devices. There are very few customers on them and large number of devices that were sold commercially without a license. It will likely be done for Pixels since we sold more than a handful of devices and everyone using the official builds is a customer. However, it won't be possible to keep them on the latest security level after the EOL date. It's likely that we'll handle it by splitting the security patch level field into an AOSP patch level and the usual full security patch level field with the full security patch level frozen after the end-of-life date.