This is definitely a huge problem, but I only see it being a doomsday scenario if you're using the default SMS app that ships with your phone (and hence cannot be updated with a patch pushed by your OEM). Assuming you're using Hangouts or Messenger[0] (which is sorta like Hangouts without Gmail), however, as your default SMS app, you should be fine as soon as they patch it. And both of those apps are freely available to download, meaning you could always grab them once they're patched and start using them as your default SMS app if you're worried about it.
Try to convince the average user to install a new app, and make it the default sms app. He will neither want nor understand the trouble of learning a new app for something that works just fine. And honestly, I don't blame them because that is not something they should have to worry about.
Android should rather work on a feature that allows them to patch their not-so-open operating system just like Apple does (or use a concept that is close to the one in the GNU/Linux world but I don't think Google is gonna do that).
This is true, but in the case of Messenger, you should consider the following:
- It's made by Google (i.e. the guys who made the phone's stock SMS app)
- It has nearly identical navigation to the stock "Messages" app, simply with a much cleaner interface
- It does not hook into anything other than your contacts, unlike Hangouts
For all intents and purposes it's the successor to the stock app, made a separate app specifically so that it can receive timely updates without being tied to a system update.
Having used both, there's really no compelling reason not to switch to it (sans the grandma-with-a-smartphone edge case who has never opened the Play Store).
Other comments have mentioned that Hangouts is not the only possible attack vector, but I'll be honest in saying that I don't really understand all this. :)
[0] https://play.google.com/store/apps/details?id=com.google.and...