We have of course made the client take contact to F-Secure. (Problem is solved I think).
My point is writing this post was to a) notify the community about a problem that can affect other people in the community, and Zope/Plone in general, and b) as in all 'politics' it is not about being right, but about getting through. This do affect the Plone community - security is one of the strengths of Plone, and it would be beneficial for the community to make sure the stack it builds on is clearly considered safe. It was not easy to actually document that Zope 2 is not end of life, I had to do a bit of digging to get the documentation. This could be made clearer in the community communication strategy.