Do I have to fix all the issues that the security review team reported?

Yes. Unless otherwise noted on the test reports, you’re required to fix all classes of issues that were sent by the review team across the entire app.