Billions of devices imperiled by new clickless Bluetooth attack (ars technica)

Zygote isn't particularly relevant - it's just the process that launches all Java-based apps and services, including system ones and user ones. (It initialises the VM and a bunch of standard classes and other widely-used resources, then every new app is launched by forking Zygote and running the app code in the new child process. That reduces app startup time, and reduces memory usage since read-only data (like the standard classes) is shared by all apps.)

Apparently the vulnerability is in native code that I expect gets compiled into somewhere like /system/lib/hw/bluetooth.default.so (if I'm reading the build scripts correctly), and gets loaded by the Java-based Bluetooth service (via JNI and some more interface layers) which is probably /system/app/Bluetooth.apk. Everything in /system is part of the firmware, and might be arbitrarily customised by the vendor (so even if Google could push security updates through the Play Store, they don't actually have the source code for those libraries (except on Nexus/Pixel devices)), so it can only be fixed in an OTA update.

If your phone is no longer getting OTA updates, throw it away and buy a new one.