Attackers would also have to have an app installed on a vulnerable handset.
Also, it's patched in Android 4.4 and up. The worst part about Android remains the speed with which handset makers and service providers stop producing updates, but even Google stopped the Galaxy Nexus, which was launched with 4.0, at 4.3. But yeah, mobile exploits....they exist across all OSes.
Cool, I (or anyone else whom I personally know) am not affected. As for lower Android versions - well, sucks for cheapskates who buy "no-name" $20 junk from eBay/DealExtreme/whatever, but I'm not really concerned about that.
Yeah, my HTC Incredible got all of one update via Verizon, and that's what bugs me about the "buy a phone, pitch in a year for newer model" cycle we're in now. Minimal attempt at fixing older revs, just focus on selling the new ones.
And I know more than a few people who get those cheap phones. They tend to get malware either via shady porn sites, or the games they let their kids download and play when they want to use the phone as a babysitter.