Is permission elevation still a security issue for end users when updating Android? Is this still an issue for end users?:

Researchers have determined that the Android update process has a vulnerability that allows permission elevation without user knowledge.

Android allows installed applications, if so designed, to obtain additional capabilities without the owner's consent, just by updating the phone's operating system to a newer version.

https://www.techrepublic.com/article/beware-of-danger-lurking-in-android-phone-updates/
From my understanding this vulnerability only works for updates that introduce new permissions. 

Therefore the update from 2.3.6 to 4.0.x which contained a lot of changes had the highest impact regarding this vulnerability. 

I have not checked it but my impression of the latest major Android updates is that the major privacy related permissions don't change very often. Therefore even if this had not been fixed by Google the attack surface is relative small. 

Additionally at that time only the static APK manifest defined permissions existed. Nowadays Android has the additionaly run-time permission system where the user is been asked to explicitly grant a specific permission to the app at run-time (e.g. sd-card access). This also reduces the impact of such an attack if it would still be possible.