The Android patch does not reach the modem
On 17 August researchers published a chain that ends up writing to Android kernel memory from the modem, with no patch and with the chip maker not answering. What made us stop was not the exploit but the patch date on the phones they tested it with: Android can carry two patch levels in a month, the second one is what covers the modem, and the phone only shows you one.