Well, there's doing both in terms of focus and effort, basically treating them as peer products. And then there is doing both in terms of "keeping the lights on for one, and focusing on the other".

Without any special insight into fly.io, I'd bet the situation is the latter. You keep the lights and fix security issues for the existing infra (which incidentally gives you money out of cashflow to invest in new efforts).