Not there aren't issues that get through (like this one, I believe), but you forgot:
1a) If the issue can be fixed and/or worked around in Play Services, Google does that and "everyone" gets the fix without even having to explicitly install it.
3b) For each OEM, if the problem can be fixed/worked around by updating the apps and/or frameworks they publish via the Play Store, they do that (if only for the sake of new and upcoming devices) and all of their customers get it once they install those update.
Those cover a large (and growing, because Google and the OEMs are both aligned on this) chunk of your "left hanging" users.
It's true that there are sometimes workarounds but they're only relevant to certain cases. This bug appears to be a good example of why you can't rely on being able to fix most or even the most severe ones with that approach.
#3b is particularly optimistic since that assumes an OEM will ship updates promptly and that's been the underlying problem here since day 1. It particularly wouldn't help if, say, a vendor ships an update for their flagship Android 5 devices which doesn't run on the 4.x devices which most all of their users have and will never receive an upgrade to Lollipop.
1a) If the issue can be fixed and/or worked around in Play Services, Google does that and "everyone" gets the fix without even having to explicitly install it.
3b) For each OEM, if the problem can be fixed/worked around by updating the apps and/or frameworks they publish via the Play Store, they do that (if only for the sake of new and upcoming devices) and all of their customers get it once they install those update.
Those cover a large (and growing, because Google and the OEMs are both aligned on this) chunk of your "left hanging" users.