SharePoint Server Subscription Edition AMA

My SharePoint Online site has external users. We gave external users "Contribute" access to a list. When our security team came to evaluate our site, I only gave them read access to the list. However, they can use "Proxy..." to hack the list. They believed that it's not secure to let external users write to a list, even though only authenticated external users are given "Contribute" access. My question is -- How can I let external users write to a SharePoint list without security concern? Also, I already had a custom SharePoint workflow, so that as soon as external users finish adding list items, their permission is immediately reduced to read only to the items. Still, my security team can hack the read-only list items. No sure why. Thanks. Thanks.