There should be some kind of process where you can report that to the owner of the store and they will take tht app offline from all devices (by revoking the developers certificate) when he doesn‘t respond within some time period.
Agree, it'll stop new spread. But it won't stop existing millions (billions?) of highly sensitive information being available to anyone with a public link