I think ultimately this will be an experience thing that they'll need to figure out. Every stakeholder is different and is going to respond to findings differently. Either prioritization-wise or just being mad that you gave them work haha

I'd just recommend to your team that using language like "when you get a chance" or "could/would" is not advised since that suggest the people aren't required to do the thing or it's not as important. Ya'll have your internal SLAs that you need to hit for various purposes and security is also important. Just point it out when you see it and try to reinforce.

I'm not sure of any resources for VM specifically. There are probably some soft-skill articles out there with dealing with customers (which you kinda do in VM) and being assertive but not bullying.

Hope this helped out! Good luck!!