This topic just came up during customer's ODA patching with the ODA bundle 18.104.22.168.0 , which was still the latest as of mid February 2017.
Apparently, RDBMS homes on the ODAs were not getting the OJVM updated.
That is still "by design" as OJVM patches are not currently covered by the ODA bundle patches.
We had opened an SR to clarify on the matters and were told via that SR that
"... There is an enhancement request submitted to include OJVM patches to ODA patchsets to ensure all the standards are being followed ..."
Additionally, we were told via the same Oracle Support SR that that OJVM patch updates could be added to ODAs still, following the normal patches conflict resolutions approaches.
For example, per this MOS document Oracle Recommended Patches -- "Oracle JavaVM Component Database PSU" (OJVM PSU) Patches (Doc ID 1929745.1)
Also, there is a possible caveat that OJVM patches may not be applied on ODAs in rolling fashion and it may need to be rolled back / removed during the future patching on the ODAs where they were installed outside of oakcli based process.
Hope this article helps to clarify the matters.
Feel free to ask questions, as always.
Sr. Principal Engineer – Oracle Engineered Systems, Cloud Solutions
c | (847) 691-8843
p | (847) 983-2958