Strange that the commit is from 2018 but it was only included in the patch level of February 5?
At least Samsung is pretty good about updating patches. Not android versions, no, but at least I still get monthly patches. My S8 already has this one.
It's not from 2018 -- Thu Apr 18 17:13:49 2019 -- the 18 may have tripped you up, it's the day of month. It's still a year old, though.
It's a cherry-pick (a copy of a commit from related code base, essentially) of this commit, https://android.googlesource.com/platform/system/bt/+/337bd4.... The bug has a different impact in Android 10 (DOS instead of RCE), which was relased in Septemer 2019. So maybe they sort of fixed it in Android 10 and somehow forgot the backport? I'm speculating.
At least Samsung is pretty good about updating patches. Not android versions, no, but at least I still get monthly patches. My S8 already has this one.