In general, you can really only count on having supported Nexus devices patched in a timely fashion. This is the reason that my employer only allows corporate access from Android phones when they are Nexuses.

> If someone could document currently shipping devices that are still vulnerable Chances are at this point in time: every single device.

> Security patch levels of July 05, 2016 or later address all applicable issues in this bulletin

My Nexus 6P is on the July 05 patch level. So is my 3 year old Nexus 7.

Unfortunately, most OEMs lag far behind what Nexus users are accustomed to.

I have been using the BlackBerry Priv since it's release. One of the best things they have going for them is how quickly they apply the android security patches once they are available.

I think they have released every security patch on the day of the public disclosure since the Priv released. This blog post shows the release dates up until March atleast, and they've hit the Nexus release dates on all of them.

http://blogs.blackberry.com/2016/03/beating-expectations-and...

EDIT:

The beta branch for the Priv already applies 5th August security patch. Usually the official release is not that far (a week or so AFAIK).

http://m.gsmarena.com/latest_priv_marshmallow_beta_brings_au...

Samsung follows the carriers where as I think they have the power that apple has to force carriers to do their bidding. My S6 edge is a few months behind android patch level but I know for a fact that the exact same model in other countries is on patch 1st July patch level. Its the same damn phone. Some people complain that old models are obsolete but what about the same newish model getting the latest security patch in one country and not in another.

Can confirm. My friend's unlocked S6 is at July patch level.