Q: Security Update 2016-001 - How much does it fix exactly?

See - About the security content of Security Update 2016-001 El Capitan and Security Update 2016-005 Yosemite

The two issues covered by this security update are instances whereby an application can run code which can cause the Kernel to disclose information that it should not, or to then be able to run further code with elevated privileges and therefore the ability to do more bad stuff.

Neither issue involves any code including the Kernel being 'infected'.

The hypothetical applications would typically have been downloaded from the Internet or copied from a memory stick or email. There is no indication that any real-world examples that exploit these two issues actually exist.