You could also trust someone on XDA, but that involves trusting a random person.
Android security is abysmal.
And for the record, macbooks had a very similar issue with intel wifi drivers not that many years ago.
Also, remember that this new vulnerability was found by Google not Apple...
Android security isn't abysmal. Third-party (non-Google) Android phones' security might be abysmal, but we should compare it to third party iPhones' security.
It was intended, and certainly branded to device manufacturers as an OS they can use and 'get all the apps'.
The hard/firmware side is part of the OS. By allowing Android to be run on any device w/o decent security, the OS inherits that.
A better solution (to my mind) would have been to restrict manufacturers from using the Android brand unless they guarenteed a certain level of support and security updates, etc.
Also, having a central (google level) set of base packages which get constant updates and are pulled into all phones, regardless of brand.
But it's too late now.