No. You can choose any fallback language that fits your original language. Think about fallbacks from "Spanish (Mexico)" to "Spanish".
No. The plugin will automatically download the fallback language if it is not already installed.
You can report security bugs through the Patchstack Vulnerability Disclosure Program. The Patchstack team helps validate, triage and handle any security vulnerabilities. Report a security vulnerability.