In "What Happens if a Third Party is Compromised?" they mention you cannot revoke an attestation once it's committed. What happens if a security audit is conducted, concludes, but a vuln is found a few years down the line?

Security audits are not perfect. Is there a way to say "new information has come up, and this version is no longer secure?"

Even with perfect security audits such a feature might be useful, e.g. when you conducted a security audit, but new SPECTRE-like attack vectors are found.