What to do with "mcrypt" message after upgrading to PHP 7.2
As the author of that message, let me try and clarify ...

The mcrypt extension is (only) used to encrypt selected passwords, and "selected" as far as I know usually only includes the smtp password, (which you may not even be using).

The message is there that so that if you upgrade your php version and the new one doesn't include mcrypt, you are aware that your encrypted passwd(s) won't be unencryptable, and you'll have to re-input them. 

Civi doesn't encrypt all passwds, and it's not a terrible thing not to encrypt them (these aren't user passwds, btw!), so the warning is just a convenience to avoid confusion and delay.

Now that mcrypt is no longer included in php, the message should get updated.

Conclusion: I'd stay on 7.2 if it's working otherwise.