I agree they did not apply the encryption, but what did they do to rectify this and to help their customers who made the mistake of buying through the marketplace.
They did very little, were obstructive to forum posts, said that the problem was too small for them to concentrate on and at the same time refused to issue working versions (even old versions) because there were so many it would have cost them too much.
Even when its not your fault, when its your product, you have a duty of care to ALL your customers not just those that buy direct, otherwise the Marketplace isn’t fit for purpose.