Millions of Android devices remain vulnerable to the Heartbleed bug a week after the flaw was made public.