It is simple really, if CertiK for example says that there is something wrong with it, you update it, do a new contract, and ask them to check it again, and if it is clear then you stay with that but if there is some more then you make another one and check it again. One project I worked with literally had 3 contracts because of an issue.
I have seen all of them get audits, and at least half of them would have another token with a new contract after the audit to fix things, and maybe like 5-10% of them would get a third one to get even a better one. Sure,it is a bad situation for the project no doubt, but having a shitty contract and sticking with it would have been even worse.