Going around your boss to their boss only makes sense if you have enough solid evidence to get your boss fired. Otherwise, you just took any pretense of a professional or even congenial relationship out back and shot it in the head.
Not necessarily. Your point should be that (a) you have security concerns, (b) your boss has a lot of concerns that he must juggle and his decision is right, (c) you feel of course that it is a shame that security concerns are not addressed, but you fully support your bosses decision. Your bosses boss has his own list of concerns. And he might then think that a website with security concerns is actually _not_ a good idea. So he disagrees with your assessment that your boss is right, he disagrees with your boss, and tells your boss to address these concerns.