Unfortunately if they've now been flagged as failing the check and you no longer have access to the VRCA file, I'd have to say yes.
I'm not currently aware of any method that allows VRChat to load security checked content, though the fact that the OP could load the avatar enough so show as visible in the menu with vrcx, you could check and see if it also happens to load the vrca file into temp storage, but I'm assuming it wouldn't let it get far enough to do so. That doesn't mean that it couldn't though, so you could check and see. If you hadn't cleared cache since the last time the avatar was available on platform, you could potentially find it amongst the temp files, but that would be a headache in and of itself, on top of the fact that we don't exactly know what the VRChat security check is examining, just broad details. If you do find it, I would think that for the avatar to pass these checks now, you'd have to unpack the vrca, rebuild avatar bones, the layers, and attempt to restore the shaders back to how they were before.
Ultimately, say unless it was an avatar you were really attached to and it isn't listed in a repository or floating out in avatar search or hosted by someone else / purchasable then unfortunately without any source file to work with, I don't see a way of salvaging the avatar and it may just have to be deleted, unless by some miracle an avatar can clear the flag without a reupload or manual inspection, but I've yet to see that happen.
