Might be an idea to also expose a function that allows a developer to check if the device has security patches applied from a given date onward using Build.VERSION.SECURITY_PATCH which will return a date and we can compare the developer submitted date to check? Not sure how up to date most devices will be though, so might only be something useful for newer devices/Gov. Its probably more relevant for what NIST want you to keep the devices up to date for - to have the latest security patches.