Upgrade to CI4 for security?

Firstly, I want to express my gratitude to all the individuals involved in the development of the CodeIgniter framework – it's truly outstanding.

We've relied on it for five years to build our Marketplace (with two full-time developers). We began with CI2 and later upgraded to CI3. Monthly, we incorporate new features into our Marketplace, and we now have a developer almost entirely dedicated to it. This context is important to comprehend the complexity of our Marketplace, which also offers Saas features to our users.

Given the critical importance of security in a Marketplace/SaaS, we had plans to migrate to CI4 and PHP 8 (currently on PHP 7.3). Unfortunately, the transition from CI3 to CI4 is a monumental task – it's essentially an application rewrite. I must admit, I felt quite disheartened when I learned that we had to rewrite our app to stay up-to-date and secure.

Now, I see two options:

Upgrade to CI4 to maintain security and accommodate new features. Realistically, I anticipate it will take us 18 months to rewrite everything. I'm also contemplating a migration to Laravel, as it appears to be managed in a more "professional" manner (apologies if this offends anyone). We're investing a significant amount in development, so I want assurance that the framework will continue to be well-maintained in the next 3-5 years.

Remain on CI3 for a few years, but then we'll have to cease adding new features because we know we'll have to rewrite everything in 2-3 years. This doesn't seem like a good return on investment. I'm not even certain if we can stay on CI3 while upgrading to PHP8, as there has been no communication regarding whether CI3 will support PHP8.

To provide some background, I'm not a developer, but I dabble in coding occasionally to assist our developers when necessary, and I like to challenge them.

Any advice or perspectives would be greatly appreciated.

Many thanks!