Google’s fix to the Bad.Build flaw only partially addresses the issue, say security researchers who discovered it.