The article mentions the S6 being vulnerable, but it had its last update 6 months ago. It also says versions below 7.0 are vulnerable, but the S6 supports 7.1. It also says the most vulnerable are phones from 2012.
I don't think it's unreasonable to say an 8 year old phone may have some security vulnerabilities. I personally don't know anyone with an 8 year old phone. I'm sure they exist, but I don't think this is an Android exclusive issue.
Further, Android is the defacto default OS for phones. Every shovelware burner sitting in a bin at the convenience store is running some version of Android. Saying "1 billion are vulernable" is surprising in that it's only 1 billion.
These include the phones that cops hack into by placing the phone in a machine that tries every pin combo between 0000 and 9999 until it unlocks.