To fully patch, yes, but the point is that Play Protect is detecting them before installation before they can be exploited, ie: on submission to Play Store or on installation on devices.

Yes, this is still a risk - if you tend to install random apks from the internet and disable Play Protect or run across an undetected modification of the relevant exploit code. But most users don't do that.

Gotcha. Still, it's a lot of RCE's coming out per month to depend on blackbox machine learning for something people use every day for their personal/business needs.