This kind of thing, without a way to update hundreds of millions of older devices (mostly owned by laypeople that aren't going to be loading custom ROMs/rooting their phone), makes Android a second-class OS. They'll become aware of the issue when their bank account gets emptied or any of the other thousands of ways this could be exploited.