New requirements come up all the time and go on the backlog for future sprints but I expect you mean the PO wants to add it to the current sprint. The PO should have the final say about the goal of the sprint. Given that you are half way through I would expect a conversation between the PO and the development team to work out what the impact will be. Maybe only part of the new item can be achieved by the end of the sprint or maybe other parts of the sprint goal should be dropped in favour of the new item.
The team should also try to understand why this new requirement didn't come up during sprint planning. Perhaps stakeholder feedback isn't being gathered as effectively as it could be or perhaps the sprint is too long, making it harder to forecast or respond to changing priorities. It's interesting that you make a distinction between PO and customer. The PO is the customer as far as the development team are concerned. Perhaps there is some disconnect here that is relevant to your question.
I don't understand your second question. What do you mean by "security" in this context?