I'm missing patches in Security > patches, and Devices > <device> > patches.
Now I haven't set them to cache because I don't want to take all the bandwidth of the server and I'd like to select what I want.
However, when I create a policy, select the bundle and deploy it to a device it works.
I have the policy configs set to default, and have enabled zac pap on a couple devices. I'm only doing this on test devices.