Replicant

I've researched a bit because of the battery consumption thread: http://redmine.replicant.us/boards/9/topics/7953 and found inside the changelog from upper Android versions (http://aosp.changelog.to/aosp-JDQ39-JWR64.html) the following patch: https://android.googlesource.com/platform/frameworks/base/+/a40cfeb with the following description:
Protect app widget broadcasts from abuse.
In this case the app was sending an APPWIDGET_UPDATE broadcast without specifying a target, which
(a) should not be allowed (you should not be able to send updates to other apps), and
(b) resulted in every single potential app widget in the system being launched... which was about 75 of them.

The source code has the following summarized comments:
"[...] we don't want apps to send this, but historically it has not been protected and apps may be using it
to poke their own app widget. So, instead of making it protected, just limit it to the caller."

With other words, this patch will limit the (APPWIDGET_UPDATE-)broadcasts (sent by the apps) to their own packages:

if (callerApp == null) {
String msg = "Permission Denial: not allowed to send broadcast " 

[this goes to the (a) from the headline-description]
and prevent every single potential app widget in the system from being launched, (triggered by this broadcasts) which drains the battery unnecessarily.
[which goes to the (b) from the headline-description].