The permission model in Android changed in Android 6.
Apps using the sdk that was released with Android 6 will have to ask users for permissions as well.
I expect that eventually older SDK's will stop working on modern Android.
So if we ignore more than half the world, 50% of users still don't get those improvement. If you're under the impression that Google isn't able to properly track devices that hit play services, that's an entirely different and more worrisome problem.
The pretty large plurality (if not majority) of Android devices in the wild don't have have Google's services installed and many of those also get no software updates -- so they're stuck on what old ROM they came with, probably Lollipop.
If the Android developer site dashboard [1] could be considered reliable, then the latest statistics show only 26.7% devices (as of yesterday, December 5, 2016) that run Marshmallow and Nougat. This leaves 73.3% devices that do not have the ability to control permissions individually (unless they've been modified with add-ons that allow it).
That dashboard practically never reflects the actual distribution of devices in use - at least according to analytics of app we've released (with several mil users across the globe).
That's because they count all the pings of devices that answered across the globe in a sliding window and that is a hugely different number than actual maket share across US and EU and comparable markets. Sure we can then go into details about how poor Indians / Chinese / Africans need secure phones too (and I agree!), but those people have no means to afford an iPhone either.
(And no, sorry, I can't provide you with NDA protected market data :/ )
