I submitted a package for security review which has a Custom Object which has internal / technical semantics only. So it's not created or even seen by users. When a user performs some action some "with sharing" classes insert, update and delete such objects.
The Security Review rejected this as "HIGH RISK CRUD and FLS Enforcement" and recommends the usage of
Schema.sObjectType.CustomInternalObject__c.isUpdateable(); and the like.
I cannot use those checks as the performing user has no direct access to those objects.
What can I do now? Is this a false positive I can explain? Any hints or experiences to share?