One of the authors still finds Android apps—verified by Google Play Protect—that are still vulnerable:

https://twitter.com/wdormann/status/1483436414025048068

Direct link to the pdf presentation:

https://resources.sei.cmu.edu/asset_files/Presentation/2015_...