This is a perfect example of selling a snake-oil solution (assuming most users are not tech-savvy) and trying to get away with "we warned them, but they chose not to act upon" attitude.
So microsoft used to let you know when updates - even scary security ones - were available but never make you take action. They've gotten way more aggressive and now you have to have specific versions or a set of DevOps skills to prevent them from regularly applying and restarting your system. Their clients are mostly like yours: non technical users of very powerful systems; why don't you force upgrade after a certain period, even if it breaks apps in order to secure them? It has to be because that's bad for your company's goals, i.e. security is important but below growth and usage.
You are right, I'm not happy about apps still leaking the data. For now, my message is to go and click the Fix button. I know it won't reach everyone, but I think it's important people hear it and do it.
In the meantime, we are stepping up our game and taking this feedback super seriously. There will be a few releases that will definitely improve the security baseline of Lovable apps.
As Head of Security you are not doing a good job.
you just need to buy Lovable Ultra