How convenient
Several key points glossed over.
This is outside of Google play, so the devices (if this number is true, which I doubt, coming from checkpoint) have all had device security intentionally disabled.
Google have patched KitKat and Lollipop, so it's not really their problem, if your device is susceptible, then it's because you bought a cheap phone and your manufacturer doesn't care about you anymore.
Lastly, how did checkpoint come up with that number. Details please. As until they do, its got all the hallmarks of classic checkpoint clickbait