So the approach is:

1. Blame the user because they didn't verify the app they built on your infrastructure meets the most basic requirements?

2. Then provide a tool that offers no guarantees and no definitions of what critical vs non-critical means.

3. And put the extra onus on users to run a "deep" scan when they intuit (somehow?) that there might be problems for which there is no hint?

4. All while telling users that critical issues are really bad but normal issues are... ok? I have no idea what they are from your writeup.

5. While selling better security for business and even better security for enterprise. Because security for everyone else isn't important!?

Is this supposed to be a roadmap to security antipatterns?

It's so interesting how you've created a nice ecosystem where you're not responsible for the security problems but at the same time your users are meant to trust you to take care of that. We really need to change the laws around this.