Yes, the terms "kernel" or "security updates" don't exist in the article at all.

Everything without upstream kernel support is inherently vulnerable.

This is why most phones are unfortunately not general purpose computers. They don't run the software you want, but only work on closed binary blobs hardcoded against specific kernel versions.