I'm sure they at least attempt to patch these, but it's often all too easy to screw up a patch and leave some part of the vulnerability still exposed. Look at what happened when Google tried to patch the stagefright vulnerability.