This points system is punishing apps for for completely avoiding privacy/security problems. If it's not applicable then it should be counted as green, such as:
-Do you get notified if a contact's fingerprint changes? 
-Is personal information (mobile number, contact list, etc.) hashed?
-Are messages encrypted when backed up to the cloud?