So, yes, if you only have one full sandbox, that is a risk. Anything worked on in the interim could be deployed to prod, but won’t be in the sandbox.
There are a few possible ways to avoid that. If your developers use SDF projects to deploy their changes, then they could easily redeploy their changes to the sandbox after the refresh as well. If you have a second full sandbox, or any developer accounts, you can deploy changes there right before activation, then deploy them back to the sandbox. Those are really the best two options to avoid releasing anything to production that isn’t fully tested and verified.