kGraft patches your kernel only "in RAM" (with kgraft-patch_3_2_1). kGraft don't install any kernel updates "on disk".
If your machine run a supported kernel version, you can safely stay with kGraft on this kernel version until EoL (end of life).

With kGraft:
=> the running kernel is fully patched "in RAM". => receive all necessary security updates by kgraft-patch
=> Your kernel images file on hard disc don't receive any security updates (by kgraft-patch)