Do I have to fix all the issues that the security review team reported?

Yes. Unless otherwise noted on the test reports, you’re required to fix all classes of issues that the review team detected across the entire app or component.