A quick word of caution
You sound very invested in trying to do something. If I can be frank, it sounds like you are at least partially motivated by your frustrations with the way the company treated you as an employee. This can be understandable, but doesn't necessarily lead to good decisions. In particular one option you mention (contacting customers and informing them of the issues) is the sort of thing that, rightly or not, and regardless of how it might end, can result in lawsuits filed against you by your former employer. So tread lightly. All things considered that is probably a very bad idea.
Understanding the (flawed) business perspective
Unfortunately the situation you describe is not uncommon in the software industry. From the perspective of many companies, bring up security issues is asking them to spend real money (in terms of developer salaries) to fix a problem that they cannot see for a benefit that may not be needed for a long time (it may in fact be a while before someone tries to hack them). It's a hidden benefit with an upfront cost, and that is something that short-sighted thinking can easily ignore for a long time. After all, from their perspective, the things you are making a big deal about have never actually caused problems but will definitely take a lot of time and effort to fix, so why should they fix it? (I'm not saying they are right, I'm just explaining the thought process).
It's important to understand that this is obviously the approach that your ex-employer is taking. You have informed them of the issue and they have decided to ignore it. There is no reason to think that any (legal) action you can take as an outsider is going to change that, especially since you failed to make any changes as an insider. Of course we know that with bad security practices, someone finding and exploiting a weakness is inevitable, especially if they start to see any real kinds of success (i.e. having a large customer base). As long as none of their customers take the time to delve into potential security concerns proactively (and most don't, because they don't know enough to look properly even if they do care), situations like this can go on for a surprisingly long time before it causes real problems. In the worst-case scenario this leads to situations like the equifax security breach. For smaller companies this can result in complete bankruptcy.
So what do you do about it? If management knows about the problem but refuses to change, there probably isn't anything you can do to force them to change. You can try things you mentioned like reporting this to their customers, but their customers may not take you seriously. For all they know you are simply a disgruntled ex-employee trying to cause trouble for your previous employer. If they didn't know enough to look into these things before starting to use the platform, then there is no reason to think they know enough to take your claims seriously now. More likely than not you'll just end up being ignored or sued.
(per @forest's answer) You certainly should submit a CVE. You could also try submitting bugs through a third-party bug bounty program. There are some that have popped up in recent years and exist to try to act as a neutral arbiter between "independent security researchers" (aka you) and sites that otherwise don't have bug reporting programs (aka your former employer). Of course such programs work only if the company you are reporting bugs to actually listen. You already know that your former employer won't. However, having published and ignored vulnerabilities through standard channels will help their customers in the long run when they do get hacked. This will change the situation from simple incompetence to outright negligence, which comes with much stiffer financial penalties in civil court (FYI: IANAL).
Any further (legal) options will vary depending on your jurisdiction, aka in Europe you may find some venues for legal action through the GDPR. In many places though you probably don't have any options that can immediately bring legal trouble to them. Most likely that won't happen until they get hacked and their customers sue. Having a published CVE will help their customers when that happens. In the meantime, it sounds like you are thinking about posting something publicly "on the internet". What would be your goal there? Realistically, your attempts to do that will probably just be ignored by the internet. It's possible however that they may end up hacked much sooner as a result though. Without going through more standard channels though, you probably dramatically increase your own risk of legal repercussions. Therefore, I would personally keep to official channels.
Again, I may be misreading you, but I think your question is largely coming from the place of someone who is angry at a past-employer and is, to some extent, looking to cause trouble. That's a good way to get yourself in legal trouble or at least give yourself a bad name when trying to find jobs in the future. I think you should try to stop looking at this from the perspective of an ex-employee and focus more on the perspective of a neutral-security-researcher.