Good you found this vulnerability.
Perhaps you can check what I proposed in Why not using ERC165 - IUUPSUpgradreable - #3 by gnarvaja as an alternative to doing the rollback test. Of course, it has the problem identified by @frangio in the reply but perhaps is safer than the current rollback test.