Explain this to your client, simply:
Using unsupported hardware poses a risk with each update, which is why we specify "not supported." If your client wants peace of mind, they should consider paying to replace their phones.
@Fanvil Technical Support, in particular, offers very interesting products for all budgets.
Otherwise, they must accept the risks associated with potential failures.
If the phones are "local" to 3CX or use a VPN (router to router) to connect to 3CX, the risks are quite low, though not zero. Similarly, if the phones utilize a "3CX SBC" to connect, the risks remain low, though not nonexistent.
Finally, if the phones are remote (aka STUN), the update to 9A should not affect them. The update is minor and only intended to replace the certificates.
https://www.3cx.com/blog/change-log/phone-system-change-log-v18/
However, once again, it will be necessary to thoroughly test the devices after the update.