This is honestly pretty bad. You either wait a month (or more) for the OS security update, if you are lucky enough that your device is supported.

Or the app could bundle the library, they can push updates faster but then again they could just use an old version and never update like most 3rd party dependencies these days.