Your answer was incomplete. You mentioned vulnerabilities, but didn't go into more details about what vulnerabilities you are talking about. You also wrote that Paul should "create a new address." He should have generated a new seed and created a completely new wallet. UKprod's answer is more complete. You were also not the first one to answer. roosbit's answer was faster and he mentioned creating a new wallet, not a new address.