I have been a Simple customer for a couple months now I absolutely LOVE the service. I have dug into what happens behind the scenes on their website and yes, they do pass more data back and forth than is always needed but they are using SSL so I'm not too worried.
You say you reached out to their security team and waited 8 days for a reply before following up, why didn't you just use Simple's support? I have reached out to them multiple times and always received a response within an hour. One of those times they redirected me to their engineering team so I could talk directly with one of their programmers, we exchanged 3-4 emails that same day. Should they have monitored this security email address you sent to better? Yes, but they provide the best support of any bank I have used in the past.
Pretty much I don't feel like the "concerns" you raised are all that important and in fact the whole post smells of FUD IMHO.