When you note a security issue like this, why wouldn't you automatically apply it?
If your terms of service can say, "When there's a data breach, it's technically your responsibility", I'm sure it can say, "When we detect a security issue, we'll push a fix without waiting for your OK."
in many cases, it's hard to understand and know is something is by design or by mistake. We are looking into having a path to take down apps that grossly violate privacy and data protection. It's a bit tricky legally so we need to find a good balance. Our thinking is so far: notification with ask to fix, grace period, if no action and no improvement - soft block until issues fixed.
If your terms of service can say, "When there's a data breach, it's technically your responsibility", I'm sure it can say, "When we detect a security issue, we'll push a fix without waiting for your OK."