iOS App has Application binary rpath set, and it's considered a vulnerability

Question

I got the following ticket from my company's security testers:

Description: The binary has Runpath Search Path (@rpath) set. In certain cases an attacker can abuse this feature to run arbitrary executable for code execution and privilege escalation. Remove the compiler option -rpath to remove @rpath. Section "macho"

But this is an issue I never heard of. We are using Carthage for part of our dependencies and others are bundled with the app and used directly.

Current rpath values ar set as follows: