I think your carrier hasn't approved it yet. T-mobile seems to lag on these things. I also can't seem to find a system update. A Google Play system update does seem to exist
We have an OS security update that is only release to users of a specific hardware, once approved by their mobile operator. It may be added to vendor-specific OS versions some time later (weeks, month or never). The vendor-specific may not be approved by a telco if the vendor doesn't have a relationship with that telco.
Now think that millions of people use the same OS on many different flavours, on different hardware, on multiple operators.
What an inneficient way of doing things.
Imagine this on the hands of Facebook scammers, then. It wouldn't last the two hours it took WSJ journalists to exploit it.