From my understanding this vulnerability only works for updates that introduce new permissions.
Therefore the update from 2.3.6 to 4.0.x which contained a lot of changes had the highest impact regarding this vulnerability.
I have not checked it but my impression of the latest major Android updates is that the major privacy related permissions don't change very often. Therefore even if this had not been fixed by Google the attack surface is relative small.
Additionally at that time only the static APK manifest defined permissions existed. Nowadays Android has the additionaly run-time permission system where the user is been asked to explicitly grant a specific permission to the app at run-time (e.g. sd-card access). This also reduces the impact of such an attack if it would still be possible.