Sophos MC - on rooting Security [ Android ]

Hi,

 I was using a trail of SMC, and end up a security flaws as below -

Environment is - Android Phone with SuperSU installed.

1. Phone enrolled with sophos Mobile Control.

2. Policy transferred [ no rooting, USB debugging off ]

3. Sophos detect as non-complaint

4. Start root browsing with any file system explorer.

5. Unroot from SuperSU.

6. SMC complaince check - Device is complient.

However, on MaaS360 it still detecting that device is not complient and rooted.

Isn't it a security flaws for Sophos MC ?

Thanks.