It is really common for any company that wants to maintain certain levels of compliance that they get a security audit. There are generally two paths forward fo

It is really common for any company that wants to maintain certain levels of compliance that they get a security audit. There are generally two paths forward for anything that is found, fix it... Or the terrifying path that is more commonly chosen "add it to the risk register". Company risk registers are signed off on by the boards, or more commonly an appointee of the board that is acting on their behalf. The risk register itself is almost never available outside the company except in some cases to major shareholders, or large business partners that make access to it a condition of a large deal. I suspect what happened here is they were told of the issues and added them to their risk register them promptly forgot about them. By doing so they accepted the liability if those risks ever became realized which would open them up to a lawsuit like this.