Upgrade to CI4 for security?

Well, in my opinion and based on experience, I don't think it will take you up to 18 months to migrate your application from CI3 to CI4.
Yes, CI4 is a complete rewrite, but it doesn't change the business logic you already have in place in your application.

Here's what I'll advise:
* Study the CI3 to CI4 upgrade guide
* Study the CI4 documentation
* Implement your current business logic in the CI4 way.

Those are the steps I took to migrate an app with over 80k users from CI3 to CI4, and it didn't take up to a month.
The most important thing is to know how to achieve the features you have in your current CI3 application, using CI4, and the docs are very helpful.