That's probably the only possible way. Fork from the previous version without the controversial change and cherry pick the security patch into it.
It's just that this might not be so easy, depending on where in the code both changes were made.