Essential Addons for Elementor could have chosen here to ask the wordpress.org security team to push a fix to vulnerable sites, but they haven’t. It’d be interesting to know why not.