One quick suggestion: If maintainer does not respond to security bugs, other than just sending reminders, there are atleast two other ways to handle this depending on how severe or how prolonged the problem is.
1) Use provenpackager rights to fix it. If you are not one already and are active in Fedora, apply to be one. Security triaging is a good enough reason to do that