You should consider opening an issue on their github [0]?
AWS, from what I know, takes security seriously, and given they themselves use OpenDistro internally, this should become a top priority for them.
[0] https://github.com/opendistro-for-elasticsearch/opendistro-b...