This was my approach until it failed. The people in a position to decide were so preoccupied by (understandable) emergent secondary effect issues that communicating the underlying issue was basically a waste of time.
The only way I could get to solving the problem was by drawing a line in the sand and refusing to work on symptoms anymore. And the only reason that was effective was because my team was so understaffed that my refusal effectively brought all feature work to a halt.
Even then, “solve the problem” buy in was shaky and constantly dismissed/side-stepped. It took a full end to end proof of concept exploit against a production system, being incredibly careful not to actually cause harm, to get support from the top (which I conjured in less than an hour and regret holding those cards as long as I did, but I was seriously worried about how I could demonstrate the vulnerability without exploiting it harmfully).
