A UK security agency warned TikTok about the exploited vulnerability more than a year earlier, but the company chose not to fix it.