We are still struggling with this issue. We have an open case with SF support and they've acknowledged that it is a bug but won't be able to fix it until after dreamforce. We have to have it fixed before dreamforce. The only solution being suggested is to make new copies of the file and relink them. We don't want to clutter the package with unnecessary files and the old global files with the security vulnerabilities will still be accessabile to everyone. On top of that we'll be in the same situation with those files once we upload them as a managed packages. 

I tried changing everything in the files to global which it allowed us to do and once we did that we were able to edit the file, but now we can't change them back to only being public even though the file was never uploaded to a managed package in that state. Now we can't even upload new versions of the package because once we upload it the change to global is supposed to be irreversible and we don't want everything in those files to be global.

There has to be somebody with a high enough level of access that can make the necessary changes, so that we can get through the security revue and be ready in time for dreamforce.